
> > with Perl and *using placeholders and bind values*, the application
> > developer has not to worry about this. So, usually I don't check the
> > values in my applications (e.g. if only values between 1 and 5 are
> > allowed and under normal circumstances only these are possible), it's the
> > task of the database (check constraint). 
> 
> That's the idea.  It's the job of the database to guarantee data
> integrety.

Yes, but what is currently missing is a protocol to the backend
where a statement is prepared with placeholders and then executed
(multiple times) with given values. Then there is no doubt what is a
value, and what a part of the SQL.

I think that this would be a wanted feature of the next
protocol version. iirc the backend side part is currently beeing 
implemented.

Andreas

Tue, 20 Aug 2002 18:14:39 +0200
"Zeugswetter Andreas SB SD" <ZeugswetterA@spardat.at>
Re: [SECURITY] DoS attack on backend possible
"Zeugswetter Andreas SB SD" <ZeugswetterA@spardat.at> writes:

> Yes, but what is currently missing is a protocol to the backend
> where a statement is prepared with placeholders and then executed
> (multiple times) with given values. Then there is no doubt what is a
> value, and what a part of the SQL.

This wouldn't have helped in the current case.  The bug is in the
datetime parser which translates strings to an external
representation, not in the SQL parser.

-- 
Florian Weimer 	                  Weimer@CERT.Uni-Stuttgart.DE
University of Stuttgart           http://CERT.Uni-Stuttgart.DE/people/fw/
RUS-CERT                          fax +49-711-685-5898

Tue, 20 Aug 2002 18:31:28 +0200
Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>
Re: [SECURITY] DoS attack on backend possible