Hi everyone, A quick follow-up to my earlier request for feedback, which unfortunately received no responses, perhaps because the changes were only available in nonprod at the time.
Since September 25, prepared-statement support has been included in the Postfix 3.12 development branch and will ship with the next stable 3.12 release. Users already running 3.12 (and those who will upgrade after 3.12 becomes stable) can improve SQL injection protection and potentially query performance, particularly when combined with proxymap, by enabling the following option in their SQL lookup configurations: statement_mode = prepared PostgreSQL additionally supports “parameterized” mode, which avoids server-side prepared statements while retaining parameterized queries. The default remains “legacy” for backward compatibility. However, a future stable release after 3.12 may switch the default to “prepared”, so users are encouraged to test their existing queries now to identify compatibility issues early. Documentation: PostgreSQL: https://www.postfix.org/pgsql_table.5.html MySQL/MariaDB: https://www.postfix.org/mysql_table.5.html SQLite: https://www.postfix.org/sqlite_table.5.html Best regards Ömer > Am 28.04.2026 um 13:01 schrieb Ömer Güven <[email protected]>: > > > Hi everyone, > > I recently submitted a small refactor of the PostgreSQL backend used by > Postfix. Wietse Venema reviewed the changes, and the updated version is now > available in the current nonprod branch (postfix-3.12-20260425-nonprod, see > dict_pgsql.c). > > We would greatly appreciate feedback from PostgreSQL users to confirm that > existing configurations and queries continue to work as expected before this > is merged into beta and stable releases. > > The rewrite introduces prepared statements, providing: > > Improved performance in high-concurrency scenarios (80-100% faster queries, > mainly after the first query per database connection due to preparation > overhead) > > Stronger protection against SQL injection by separating query structure from > data, removing the need for error-prone manual escaping > > The primary goal of this change is security hardening and more robust > handling of query input. As individual queries took already sub-milliseconds > to complete, the performance gain might not be noticable directly. > > No configuration changes should be required. If you encounter any issues, it > would be very helpful if you could share the affected query that fails to > convert into a prepared statement, either with me or Wietse. > > Thank you for your support! > > Ömer > > _______________________________________________ > Postfix-users mailing list -- [email protected] > To unsubscribe send an email to [email protected]
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Postfix-users mailing list -- [email protected] To unsubscribe send an email to [email protected]
