6 ms·
is it works also with prepared statements ? or only with really lame code ?
by devmach 15y ago
is it works also with prepared statements ? or only with really lame code ?
- troels 15y agoIt's injection attacks. Using prepared statements will prevent that.
- jeltz 15y agoIt is not actually prepared statements that does that, it is parametrized statements. Prepared statements is a related by mostly orthogonal concept. Prepared statements are about caching parsing and query planning and storing queries for future use, this gains performance and convenience but not necessarily security. You can use parametrized queries without storing them as prepared queries at the server. This is what Perl DBI, libpq (the C binding for PostgreSQL) and many others do. In PostgreSQL you can use PREPARE and EXECUTE directly instead of through the convenience functions in your driver and be vulnerable to SQL injections. E.g. PREPARE foo (boolean) AS SELECT $1; EXECUTE foo (pg_terminate_backend(42)));