Re: binds only for s,u,i,d?

Greg Stark wrote:

>Neil Conway <neilc@samurai.com> writes:
>
>  
>
>>On Mon, 2006-07-03 at 23:28 -0400, Agent M wrote:
>>
>>    
>>
>>>Why can't preparation be used as a global anti-injection facility?
>>>      
>>>
>>All that work would need to be deferred to EXECUTE-time, which would largely
>>defeat the purpose of server-side prepared statements, no?
>>    
>>
>
>It would also defeat the anti-injection purpose. If you can use parameters to
>change the semantics of the query then you're not really protected any more.
>The whole security advantage of using parameters comes from knowing exactly
>what a query will do with the data you provide.
>
>  
>
Exactly. In particular, the suspect data should never hit the parser. 
You can defeat that with a function call, of course, but you have to 
work at it.

cheers

andrew