[GENERAL] Avoiding SQL injection in Dynamic Queries (in plpgsql)

2010-03-17 Thread Allan Kamau
When writing dynamic commands (those having "EXECUTE 'some SQL query';), is there a way to prevent interpretation of input parameters as pieces of SQL commands? Does quote_literal() function implicitly protect against this unwanted behaviour. Allan. -- Sent via pgsql-general mailing list (pgsql-

Re: [GENERAL] Avoiding SQL injection in Dynamic Queries (in plpgsql)

2010-03-17 Thread Craig Ringer
Allan Kamau wrote: > When writing dynamic commands (those having "EXECUTE 'some SQL > query';), is there a way to prevent interpretation of input parameters > as pieces of SQL commands? EXECUTE ... USING -- Craig Ringer -- Sent via pgsql-general mailing list (pgsql-general@postgresql.org) To m

Re: [GENERAL] Avoiding SQL injection in Dynamic Queries (in plpgsql)

2010-03-17 Thread Allan Kamau
On Wed, Mar 17, 2010 at 11:41 AM, Craig Ringer wrote: > Allan Kamau wrote: >> When writing dynamic commands (those having "EXECUTE 'some SQL >> query';), is there a way to prevent interpretation of input parameters >> as pieces of SQL commands? > > EXECUTE ... USING > > -- > Craig Ringer > Thanks

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Herouth Maoz
On Mar 3, 2010, at 18:01 , Josh Kupershmidt wrote: > Though next time you see a query which doesn't respond to > pg_cancel_backend(), try gathering information about the query and what the > backend is doing; either you're doing something unusual (e.g. an app is > restarting the query automati

Re: [GENERAL] Avoiding SQL injection in Dynamic Queries (in plpgsql)

2010-03-17 Thread Pavel Stehule
2010/3/17 Allan Kamau : > When writing dynamic commands (those having "EXECUTE 'some SQL > query';), is there a way to prevent interpretation of input parameters > as pieces of SQL commands? Does quote_literal() function implicitly > protect against this unwanted behaviour. quote_literal, quote_id

Re: [GENERAL] return row from plpgsql?

2010-03-17 Thread zhong ming wu
On Wed, Mar 17, 2010 at 12:00 AM, Osvaldo Kussama wrote: > > For a RETURN SETOF function use: > > SELECT * FROM aplpgsqlfunction('%u'); > > http://www.postgresql.org/docs/current/interactive/plpgsql-control-structures.html#PLPGSQL-STATEMENTS-RETURNING > > Osvaldo > I didn't know about RETURN SETO

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Craig Ringer
On 17/03/2010 6:32 PM, Herouth Maoz wrote: On Mar 3, 2010, at 18:01 , Josh Kupershmidt wrote: Though next time you see a query which doesn't respond to pg_cancel_backend(), try gathering information about the query and what the backend is doing; either you're doing something unusual (e.g. an a

[GENERAL] Bulkdelete and Vacuum operations on custom index

2010-03-17 Thread Carsten Kropf
Hi all, I am currently implementing some index access methods on top of PostgreSQL. Until now, it is pretty fine and working properly. However, I am now doing the implementation of bulk deletion and vacuum of the structure. I don't know exactly, how to achieve this because it would be much easie

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Herouth Maoz
On Mar 17, 2010, at 13:34 , Craig Ringer wrote: > On 17/03/2010 6:32 PM, Herouth Maoz wrote: >> >> On Mar 3, 2010, at 18:01 , Josh Kupershmidt wrote: >> >>> Though next time you see a query which doesn't respond to >>> pg_cancel_backend(), try gathering information about the query and >>> what

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Craig Ringer
On 17/03/2010 8:43 PM, Herouth Maoz wrote: On Mar 17, 2010, at 13:34 , Craig Ringer wrote: On 17/03/2010 6:32 PM, Herouth Maoz wrote: On Mar 3, 2010, at 18:01 , Josh Kupershmidt wrote: Though next time you see a query which doesn't respond to pg_cancel_backend(), try gathering information

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Herouth Maoz
On Mar 17, 2010, at 14:56 , Craig Ringer wrote: > On 17/03/2010 8:43 PM, Herouth Maoz wrote: >> >> On Mar 17, 2010, at 13:34 , Craig Ringer wrote: >> >>> On 17/03/2010 6:32 PM, Herouth Maoz wrote: On Mar 3, 2010, at 18:01 , Josh Kupershmidt wrote: > Though next time you see

[GENERAL] db error messages when I try to debug with pgadmin

2010-03-17 Thread josep porres
Hi guys, I cannot debug with pgadmin 1.10.2, I get an error in both debugging options. I have de debugging plugin loaded in a 8.4.3 server These are the errors I get DEBUG CONTEXT MENU OPTION I set the parameter values and hit OK. ERROR: function plpgsql_oid_debug(integer, integer) does not

Re: [GENERAL] app table names

2010-03-17 Thread Vick Khera
On Tue, Mar 16, 2010 at 5:25 PM, Justin Graf wrote: >> Do not mix data from multiple applications in one database. Use >> multiple databases to isolate them entirely. >> >> > That's not always a practical solution to the problem, > > the Apps may need to share numerous tables, duplicating the data

Re: [GENERAL] Unexpected result from selecting an aliased but non-existing column called "name"

2010-03-17 Thread Ian Barwick
Hi Adrian, 2010/3/9 Adrian Klaver : > On Tuesday 09 March 2010 12:50:45 am Ian Barwick wrote: >> Hi >> >> I was wondering where some spurious information in a query was >> coming from - it looked like something was inserting all the >> values of a table row as a comma-separated list. >> >> It turn

[GENERAL] DBT-2 Error

2010-03-17 Thread Chokshi, Meghaben
Can someone help me to install DBT-2 ? I did set up environment variables. But still I am getting errors I installed it and run_workload. I am getting these errors: [postg...@asnl dbt2-0.40]$ scripts/run_workload.sh -d 200 -w 1 -c 5 server starting * Results can be found in output/

Re: [GENERAL] Bulkdelete and Vacuum operations on custom index

2010-03-17 Thread Tom Lane
Carsten Kropf writes: > I am currently implementing some index access methods on top of > PostgreSQL. Until now, it is pretty fine and working > properly. However, I am now doing the implementation of bulk deletion > and vacuum of the structure. I don't know exactly, how to achieve this > because

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Tom Lane
Craig Ringer writes: > On 17/03/2010 8:43 PM, Herouth Maoz wrote: >> (gdb) backtrace >> #0 0x8dfcb410 in ?? () >> #1 0xbff10a28 in ?? () >> #2 0x083b1bf4 in ?? () >> #3 0xbff10a00 in ?? () >> #4 0x8db98361 in send () from /lib/tls/i686/cmov/libc.so.6 >> #5 0x08195d54 in secure_write () >> #6

Re: [GENERAL] stopping processes, preventing connections

2010-03-17 Thread Greg Smith
Herouth Maoz wrote: Aren't socket writes supposed to have time outs of some sort? Stupid policies notwithstanding, processes on the client side can disappear for any number of reasons - bugs, power failures, whatever - and this is not something that is supposed to cause a backend to hang, I wo

[GENERAL] building a c function

2010-03-17 Thread Stuart McGraw
Hello all, I know this is a very elementary question, but my excuse is I have not programmed in C or written makefiles for 15+ years... I am trying to write a C-language function, call it my_func. But I also have a my_subs.o that does the heavy lifting for my_func.c. My makefile is: MODULES

[GENERAL] update ... set ... subquery

2010-03-17 Thread John Smith
guys, trying multiple updates without success like so: update a set number = any ( select number from b where a.number=b.number) where number is null; >> 'syntax error at or near "any"' subquery returns more than one row. using 8.1. thks, jzs -- Sent via pgsql-general mailing li

Re: [GENERAL] building a c function

2010-03-17 Thread Tom Lane
Stuart McGraw writes: > MODULES = my_func > PG_CONFIG = pg_config > PGXS := $(shell $(PG_CONFIG) --pgxs) > include $(PGXS) > OBJS = my_subs.o # Is this right? Not entirely certain, but I think you need to set all the variables *before* including $(PGXS), so ordering above is no good. Also I

Re: [GENERAL] update ... set ... subquery

2010-03-17 Thread Szymon Guz
2010/3/17 John Smith > guys, > trying multiple updates without success like so: > > update a > set number = any ( select number from b where > a.number=b.number) > where number is null; > >> 'syntax error at or near "any"' > > subquery returns more than one row. using 8.1. > thks,

Re: [GENERAL] building a c function

2010-03-17 Thread Carsten Kropf
Hello, I think, what you probably want to do is something like that: MODULE_big = my_funcs OBJS = myfunc.o mysubs.o PG_CONFIG=/usr/local/pgsql/bin/pg_config PGXS := $(shell $(PG_CONFIG) --pgxs) include $(PGXS) Then you will get a shared library called "my_funcs" which includes both of your *.o s

Re: [GENERAL] update ... set ... subquery

2010-03-17 Thread hubert depesz lubaczewski
On Wed, Mar 17, 2010 at 03:13:26PM -0400, John Smith wrote: > guys, > trying multiple updates without success like so: > > updatea > set number = any ( select number from b where a.number=b.number) > where number is null; > >> 'syntax error at or near "any"' > > subquery return

Re: [GENERAL] update ... set ... subquery

2010-03-17 Thread John Smith
guys, sorry my query is like so: update a set number = any ( select number from b where a.name=b.name ) where number is null; simplified table a: sn | number| name -- 1 | 101 | john 2 | null | mary 3 | 127

Re: [GENERAL] update ... set ... subquery

2010-03-17 Thread Alban Hertroys
On 17 Mar 2010, at 21:40, John Smith wrote: > guys, > sorry my query is like so: > update a > set number = any ( select number from b where a.name=b.name ) > where number is null; > Looks like you want: update a set number = b.number from b where number is null and name = b.name; > sim