| Lists: | pgsql-bugs |
|---|
| From: | guettliml(at)thomas-guettler(dot)de |
|---|---|
| To: | pgsql-bugs(at)postgresql(dot)org |
| Subject: | BUG #13753: Docs for plpy.execute() miss info about quoting |
| Date: | 2015-11-03 13:22:44 |
| Message-ID: | 20151103132244.2762.96085@wrigleys.postgresql.org |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Lists: | pgsql-bugs |
The following bug has been logged on the website:
Bug reference: 13753
Logged by: Thomas Güttler
Email address: guettliml(at)thomas-guettler(dot)de
PostgreSQL version: 9.4.5
Operating system: Linux
Description:
This page misses important information:
http://www.postgresql.org/docs/9.4/static/plpython-database.html
How to quote the arguments?
The relevant information is here:
http://www.postgresql.org/docs/9.4/static/plpython-util.html
Please include a link from the execute() docs to the quoting docs.
I was trapped by a bug made by a team mate who did no quoting.
Not quoting the values of a SQL query can lead to SQL injects which are a
big security concern.
Please add a note to the docs.
Thank you.
| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | guettliml(at)thomas-guettler(dot)de |
| Cc: | pgsql-bugs(at)postgresql(dot)org |
| Subject: | Re: BUG #13753: Docs for plpy.execute() miss info about quoting |
| Date: | 2015-11-03 17:03:51 |
| Message-ID: | 9076.1446570231@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Lists: | pgsql-bugs |
guettliml(at)thomas-guettler(dot)de writes:
> This page misses important information:
> http://www.postgresql.org/docs/9.4/static/plpython-database.html
> How to quote the arguments?
AFAICS, none of the examples shown there require quoting of arguments,
so the issue doesn't really come up naturally.
> The relevant information is here:
> http://www.postgresql.org/docs/9.4/static/plpython-util.html
> Please include a link from the execute() docs to the quoting docs.
We cannot put everything on one page; that will not make it more
readable or understandable.
regards, tom lane