Timeline for How to make PostreSQL functions private (inaccessible to end users)?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 18, 2018 at 7:32 | comment | added | Evan Carroll | This has nothing to do with SQL Injection. First, every function that gets any parameter unquoted is a target for SQL Injection. Second, it's not clear what the issues you were having that are not addressed in the answers there. Third your design is pretty flawed, which is exactly what I answered with a few days ago If your public facing functions are dropping and recreating tables in unspecified schemas, you have a large footprint for attack. | |
| Mar 18, 2018 at 2:43 | history | edited | tinlyx | CC BY-SA 3.0 |
added clarification
|
| Mar 18, 2018 at 2:37 | history | rollback | tinlyx |
Rollback to Revision 1
|
|
| Mar 18, 2018 at 1:10 | comment | added | Evan Carroll | Also, when you say "supporting functions" what do you mean? | |
| Mar 18, 2018 at 1:10 | comment | added | Evan Carroll | I think you need to state why you think private/public would have anything to do with SQL-injection. SQL-Injection is called by a failure to escape parameters. I don't believe it has anything to do with the question. | |
| Mar 18, 2018 at 1:09 | history | edited | Evan Carroll | CC BY-SA 3.0 |
edited tags
|
| Mar 18, 2018 at 1:04 | answer | added | Evan Carroll | timeline score: 4 | |
| Mar 18, 2018 at 0:17 | history | asked | tinlyx | CC BY-SA 3.0 |