Re: contrib: hack for psycopg2 performance

On 12/05/2010 13:40, Karsten Hilbert wrote:
>> > _Assuming_ that psycopg will work fine in both cases, *Params and not *Params (in the
>> > set of queries accepted by the more restrictive), why should the user
>> > be loaded with the burden of choosing which one to use?
> Because *Params offers a quantitative advantage (speed) and
> a qualitative advantage (*ridding* oneself of SQL injection).
> 
> Also note that I am not asking the burden the user with the
> *requirement* to choose, rather only with the option.

I agree that there is no reason to _remove_ a choice. But note that
doing SQL injection with psycopg is almost impossible because of what
Daniele explained.

>> > There is a big fat assumption above, but psycopg doesn't use (anymore)
>> > its own quoting algorithm, which may be flawed: it is using the libpq
>> > PQescapeStringConn, so we can assume it is as secure as the backend
>> > is.
> I know but it is more secure to perform the
> possibly-safe-possible-unsafe escaping *inside* the server
> *inside* the backend because in that case no injection *can*
> happen while on the wire *towards* the server.

Then use an SSL connection. Nothing less is secure enough. :)

federico

-- 
Federico Di Gregorio    <mailto:fog-NGVKUo/i/[email protected]> <jid:[email protected]>
DISCLAIMER. If I receive a message from you, you are agreeing that:
 1. I am by definition, "the intended recipient".
 2. All information in the email is mine to do with as I see fit and
 make such financial profit, political mileage, or good joke as it lends
 itself to. In particular, I may quote it on USENET or the WWW.
 3. I may take the contents as representing the views of your company.
 4. This overrides any disclaimer or statement of confidentiality that
 may be included on your message.

_______________________________________________
Psycopg mailing list
Psycopg-IAPFreCvJWPBWskQ1e/[email protected]
http://lists.initd.org/mailman/listinfo/psycopg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkvqnmMACgkQvcCgrgZGjeu9hACgvifat/HZi0izJBXmq2dZElCY
/3QAnRIPLKTL9wAHFvQ6Hi8dshTTcXU3
=4oSS
-----END PGP SIGNATURE-----