Re: Wierd "ProgrammingError" with "E" string prefix

Il giorno mer, 04/03/2009 alle 11.18 +0100, Karsten Hilbert ha scritto:
> On Wed, Mar 04, 2009 at 09:59:34AM +0100, Federico Di Gregorio wrote:
> 
> > > BUUUTTTT.... we all learned from xkcd (little droppi table) that using
> > > string substitution to create SQL is a visit to the dark side.
> > > So, my question: is there any sql-injection save way to dynamically
> > > insert table-names into a SQL?
> > 
> > Not right now. We can probably add a wrapper that is quoted by psycopg
> > according to PostgreSQL rules for indentifiers. I never needed that
> > because I never needed to use untrusted data to operate on the database
> > schema, so patches are welcome.
> > 
> > Something like:
> > 
> > curs.execute("DROP TABLE %s", (Identifier(unstrusted_data),))
> 
> Should this, then, translate to
> 
> 	drop table quote_ident(untrusted_data);
> 
> or am I on the wrong track ?

Yes, but unfortunately DROP does not take SQL functions, just
identifiers. So the quoting must happen on Python side.

federico

-- 
Federico Di Gregorio                         http://people.initd.org/fog
Debian GNU/Linux Developer                                [email protected]
INIT.D Developer                                           fog-NGVKUo/i/[email protected]
 Io non sono romantica. La candelina sul tavolo mi vede e si spegne.
                                                     -- sisterconfusion

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEABECAAYFAkmuXe8ACgkQvcCgrgZGjes+vQCfXCib0rrOiQoMxyIynXVdJI3/
P3MAoIR3Kqgf0eOjTeB1+raN0QmSfueJ
=ZhB7
-----END PGP SIGNATURE-----