Re: query checking

    Probably the most direct way to look for and catch such attempts would
be to search for the semi-colon ';' and if it exists just give an error.

Chris Ryan
chris@greatbridge.com

s wrote:
>
> I am writing a site that
> does select/insert SQL commands with users input.
>
> There is a potential hazard if some one tries to execute there
> own commands in an input box
> eg.    the user types into the input  box on a form  -   [ "; delete *
> from table; ]
>
> I'm after a regular expression (that'd be nice) or an algorithm to
> tell that only one query is being passed to psql at a time.
>
> The query string will be processed if
> Either - one SELECT command only
>            - one INSERT command only
>            - one UPDATE command only
> ELSE - dont process query
>
> Any input would be much appreciated.
> thanks,
> stef