[PD] [psql] object hand-holding

[Mathieu Bouchard]

On Mon, 10 Dec 2007, Mike McGonagle wrote:

> I guess what I am getting at is that I don't see how we can prevent people
> from using this maliciously.

Using true placeholders or other form of automatic quoting.

> If they are creating the SQL and putting the data into it, how can we 
> stop them from being idiots?

If you have automatic quoting, you don't even have to think about who is 
an idiot and who isn't. I don't want to think about who's an idiot and who 
isn't. I don't want you to think about it.

> Are you saying that we need to do data checking prior to the data being 
> sent to the server?

If you quote your data properly then you don't need to check whether the 
data will garble the query's syntax or not. Therefore, no, I don't think 
what you need to do on the data is a "check"... though at the character 
level, you have to "check" in order to know which chars have to be 
replaced.

  _ _ __ ___ _____ ________ _____________ _____________________ ...
| Mathieu Bouchard - tél:+1.514.383.3801, Montréal QC Canada