Re: question

Поиск
Список
Период
Сортировка
От Vivek Khera
Тема Re: question
Дата
Msg-id 9158F005-5B73-405A-8CD6-97D6B4621F62@khera.org
обсуждение исходный текст
Ответ на question  ("Matt A." <survivedsushi@yahoo.com>)
Список pgsql-sql
On Aug 24, 2005, at 1:05 AM, Matt A. wrote:

> We used nullif('$value','') on inserts in mssql.  We
> moved to postgres and love it but the nullif() doesn't
> match empty strings to each other to return null other
> than a text type, causing an error. This is a major
> part of our application.

I *certainly* hope you're not passing $value in straight from your  
web form directly into the SQL.  You're opening yourself up for SQL  
injection attacks.

Why not just have your app that reads the form generate the proper  
value to insert? That is the safe route.

Vivek Khera, Ph.D.
+1-301-869-4449 x806




В списке pgsql-sql по дате отправления:

Предыдущее
От: Halley Pacheco de Oliveira
Дата:
Сообщение: Re: question
Следующее
От: "Thomas F. O'Connell"
Дата:
Сообщение: Re: Numerical variables in pqsql statements