SQL sanitization?

[iwinux]

SQL sanitization?

[bmizerany]

Yes. It uses Postgres's prepared statements.

See Bind
http://www.postgresql.org/docs/9.0/static/protocol-message-formats.html

Example:

// This will be parsed and bound by postgres.
// Never use ... " WHERE foo = " + mystring and you'll be as safe as
postgres makes you safe.
db.Query("SELECT * FROM mytable WHERE foo = ?", "bar")

On Sun, Oct 21, 2012 at 4:49 AM, Limbo Peng [email protected]:

Will this library provides SQL-sanitization that helps avoid SQL-injection?

—
Reply to this email directly or view it on GitHubhttps://github.com/bmizerany/pq/issues/48.

[iwinux]

thanks :)

Two related questions:

1. should I do anything to escape some special characters?
2. how can I inspect the final SQL statement that is actually executed?

[bmizerany]

That's a great question for the Postgres mailing list. I'm sure these
question have been answered in more detail there than I can do here.

In short:
You'll need to see the manual on escape characters in psql and check out
how to debug queries in Postgres.

On Monday, October 22, 2012, Limbo Peng wrote:

thanks :)

Two related questions:

1. should I do anything to escape some special characters?

2. how can I inspect the final SQL statement that is actually
   executed?

   —
   Reply to this email directly or view it on GitHubhttps://github.com/bmizerany/pq/issues/48#issuecomment-9685628.