Re: contrib: hack for psycopg2 performance

Hi,

How do I unsubscribe from this mailing list?


-----Original Message-----
From: psycopg-bounces-IAPFreCvJWPBWskQ1e/[email protected]
[mailto:psycopg-bounces-IAPFreCvJWPBWskQ1e/[email protected]] On Behalf Of Federico Di
Gregorio
Sent: Wednesday, 12 May, 2010 8:26 PM
To: psycopg-IAPFreCvJWPBWskQ1e/[email protected]
Subject: Re: [Psycopg] contrib: hack for psycopg2 performance

On 12/05/2010 13:40, Karsten Hilbert wrote:
>> > _Assuming_ that psycopg will work fine in both cases, *Params and
not *Params (in the
>> > set of queries accepted by the more restrictive), why should the
user
>> > be loaded with the burden of choosing which one to use?
> Because *Params offers a quantitative advantage (speed) and
> a qualitative advantage (*ridding* oneself of SQL injection).
> 
> Also note that I am not asking the burden the user with the
> *requirement* to choose, rather only with the option.

I agree that there is no reason to _remove_ a choice. But note that
doing SQL injection with psycopg is almost impossible because of what
Daniele explained.

>> > There is a big fat assumption above, but psycopg doesn't use
(anymore)
>> > its own quoting algorithm, which may be flawed: it is using the
libpq
>> > PQescapeStringConn, so we can assume it is as secure as the backend
>> > is.
> I know but it is more secure to perform the
> possibly-safe-possible-unsafe escaping *inside* the server
> *inside* the backend because in that case no injection *can*
> happen while on the wire *towards* the server.

Then use an SSL connection. Nothing less is secure enough. :)

federico

-- 
Federico Di Gregorio    <mailto:fog-NGVKUo/i/[email protected]> <jid:[email protected]>
DISCLAIMER. If I receive a message from you, you are agreeing that:
 1. I am by definition, "the intended recipient".
 2. All information in the email is mine to do with as I see fit and
 make such financial profit, political mileage, or good joke as it lends
 itself to. In particular, I may quote it on USENET or the WWW.
 3. I may take the contents as representing the views of your company.
 4. This overrides any disclaimer or statement of confidentiality that
 may be included on your message.