note 14084 modified in function.pg-exec by yohgaki

I don't know whether to call this a feature or a bug but there is a security concern with the way pg_exec() passes queries on to PostgreSQL. That is, be very careful of the use of GET or POST variables being used in your queries.<br> <br> This is because multiple queries can be run for each call to pg_exec(). This means that a rather benign looking query such as:<br> <br> select * from sometable where field='$post_value'<br> <br> However, if the $post_value was set to "'; insert into sometable(descr) values ('I am a nasty hacker type person, so there! Ha ha!'); select * from sometable where field = 'x" the foreign user has now just modified your database. This could be VERY bad.<br> <br> The user only needs to know something about the structure of your SQL and about your database schema. Since many projects using PHP are OpenSource, many projects have this information on display for anyone to discover. So, be careful! [Editor's Note] Use addslashes() to escape single quote. Enabling magic_qoute_gpc is not recommended for performance reason. --was-- I don't know whether to call this a feature or a bug but there is a security concern with the way pg_exec() passes queries on to PostgreSQL. That is, be very careful of the use of GET or POST variables being used in your queries.<br> <br> This is because multiple queries can be run for each call to pg_exec(). This means that a rather benign looking query such as:<br> <br> select * from sometable where field='$post_value'<br> <br> However, if the $post_value was set to "'; insert into sometable(descr) values ('I am a nasty hacker type person, so there! Ha ha!'); select * from sometable where field = 'x" the foreign user has now just modified your database. This could be VERY bad.<br> <br> The user only needs to know something about the structure of your SQL and about your database schema. Since many projects using PHP are OpenSource, many projects have this information on display for anyone to discover. So, be careful! http://www.php.net/manual/en/function.pg-exec.php