1

I wrote this prepared statement for inserting jsonb data into a table:

PREPARE posts_insert(jsonb) AS
  INSERT INTO posts(data) VALUES($1) RETURNING ID;

Though I'm concerned if this query has some kind of vulnerabilities. The json comes from the client side of my application, so it could basically contain anything. Is it dangerous to use jsonb (that comes from the user) within queries? What can I do to make it safe or more safe?

1

Is it dangerous to use jsonb (that comes from the user) within queries?

Not it's not dangerous because that JSON is essentially just text as it comes from the client, and you've protected yourself by using prepared statements. This text will be transparently fed to the internal function jsonb_in, and you'll be totally safe.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.