Re: SQL injections - 03-31-2010 , 09:30 AM

Anselmo Canfora wrote:

Quote:

query issued to Postgres: select quote_literal(''); drop table IDoNotExist; --') as result DBD::Pg::st execute failed: ERROR: table "idonotexist" does not exist DBD::Pg::st fetchall_arrayref failed: no statement executing http://search.cpan.org/~turnstep/DBD....1/Pg.pm#quote seems to be very suited for the purpose thanks!

Yes, that is exactly what you need.

Yours,
Laurenz Albe