CODEWITHSUNDEEP
postgresqlsecuritydollar-quoting
Noob Life
Noob Life

Reputation: 580

Is dollar-quoting in Postgres enough to escape malicious inputs?

Is dollar quoting enough to prevent malicious inputs like SQL injection?

For example:

SELECT * FROM mytable WHERE title = $secret$ hack'-- $secret$

where user input is

hack'--

Upvotes: 0

Views: 130

Answers (1)

Laurenz Albe
Laurenz Albe

Reputation: 246598

No, of course not, because the hacker could enter a string containing $secret$.

What you suggest goes by the name “security by obscurity” and enjoys ill respect among security experts. For example, it would not work at all with open source software.

Fortunately PostgreSQL and all relevant APIs have functions that make the safe construction of SQL statements simple.

Upvotes: 1

Related Questions