CODEWITHSUNDEEP
pythonpostgresqlsql-injection
Meir Tseitlin
Meir Tseitlin

Reputation: 2038

PostgreSQL COPY SQL injection

I am using PostgreSQL 11 COPY command to import large CSVs into the DB with Python, like the following:

COPY "ns"."table" ("col1", "col2") FROM STDIN WITH CSV HEADER DELIMITER AS ','

I didn't find any recent information if this operation is secure in terms of SQL injection attacks or should I manually go over the CSV and escape every value in the file (which is a very heavy operation).

Thanks!

Upvotes: 3

Views: 1301

Answers (1)

Laurenz Albe
Laurenz Albe

Reputation: 246453

There is no danger of SQL injection with this command.

If a user supplies bad data, then you end up with bad data in the table, or at worst you could get an error because the file is not correct CSV or because a constraint was violated.

But there is no way to subvert security to execute statements, because nothing entered by the user will become part of an SQL statement. With COPY, there is a clear distinction between SQL statement and data.

Upvotes: 7

Related Questions