On Mon, Mar 23, 2009 at 01:07:18AM -0600, Scott Marlowe wrote: > On Mon, Mar 23, 2009 at 12:59 AM, Stephen Cook <scli...@gmail.com> wrote: > > You should use pg_query_params() rather than build a SQL statement > > in your code, to prevent SQL injection attacks. Also, if you are > > going to read this data back out and show it on a web page you > > probably should make sure there is no rogue HTML or JavaScript or > > anything in there with htmlentities() or somesuch. > > Are you saying pg_quer_params is MORE effective than > pg_escape_string at deflecting SQL injection attacks?
Yes. Much more. Cheers, David. -- David Fetter <da...@fetter.org> http://fetter.org/ Phone: +1 415 235 3778 AIM: dfetter666 Yahoo!: dfetter Skype: davidfetter XMPP: david.fet...@gmail.com Remember to vote! Consider donating to Postgres: http://www.postgresql.org/about/donate -- Sent via pgsql-general mailing list (pgsql-general@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-general
