Re: contrib: hack for psycopg2 performance

On Wed, May 12, 2010 at 02:26:11PM +0200, Federico Di Gregorio wrote:

> >> > There is a big fat assumption above, but psycopg doesn't use (anymore)
> >> > its own quoting algorithm, which may be flawed: it is using the libpq
> >> > PQescapeStringConn, so we can assume it is as secure as the backend
> >> > is.
> > I know but it is more secure to perform the
> > possibly-safe-possible-unsafe escaping *inside* the server
> > *inside* the backend because in that case no injection *can*
> > happen while on the wire *towards* the server.
> 
> Then use an SSL connection. Nothing less is secure enough. :)

I know, we already do.

Anyway, I was just tossing out my arguments.

Also, if *Params does end up being used for executemany() I
can always revert to using that instead of execute() if
that's what I need.

Karsten
-- 
GPG key ID E4071346 @ wwwkeys.pgp.net
E167 67FD A291 2BEA 73BD  4537 78B9 A9F9 E407 1346