On Mon, Mar 23, 2009 at 01:07:18AM -0600, Scott Marlowe wrote: > On Mon, Mar 23, 2009 at 12:59 AM, Stephen Cook <sclists@xxxxxxxxx> wrote: > > You should use pg_query_params() rather than build a SQL statement > > in your code, to prevent SQL injection attacks. Also, if you are > > going to read this data back out and show it on a web page you > > probably should make sure there is no rogue HTML or JavaScript or > > anything in there with htmlentities() or somesuch. > > Are you saying pg_quer_params is MORE effective than > pg_escape_string at deflecting SQL injection attacks? Yes. Much more. Cheers, David. -- David Fetter <david@xxxxxxxxxx> http://fetter.org/ Phone: +1 415 235 3778 AIM: dfetter666 Yahoo!: dfetter Skype: davidfetter XMPP: david.fetter@xxxxxxxxx Remember to vote! Consider donating to Postgres: http://www.postgresql.org/about/donate -- Sent via pgsql-general mailing list (pgsql-general@xxxxxxxxxxxxxx) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general
