A Word About SQL Injection
Explore how SQL injection vulnerabilities occur and understand PostgreSQL's protocol-level mechanisms that separate query text from parameters to prevent them. Learn best practices for using application drivers like psycopg to securely handle SQL queries without risking injection.
We'll cover the following...
An SQL injection is a security breach, one made famous by the “Exploits of a Mom” xkcd comic episode in which we read about Little Bobby Tables.
An SQL injection happens when the database server is mistakenly led to consider a dynamic argument of a query as part of the query text. PostgreSQL implements a protocol-level facility to send the static SQL query text separately from its dynamic arguments. Sending those parts as separate entities over the protocol means that ...