News for hackers. Stuff that matters.

A comment on Using Multi-Byte Characters to Nullify SQL Injection Sanitizing. Parent comment

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by greenleafjacob on Sunday June 26, 2016 @05:50AM (#11980069)
In Postgres until 9.2, the query plan for prepared statements is fixed at prepare time rather than time of execution, so you might end up with worse query plans. It's worth noting that 9.1 is still the version in Ubuntu 12.04, it's only 14.04 that has 9.3.
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by icebraining on Sunday June 26, 2016 @07:29AM (#11980347)
It should be noted that Postgres offers a repository with the latests versions even for Ubuntu 12.04, so you don't need to upgrade the distro or compile PG yourself to use them.
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by hultner on Sunday June 26, 2016 @08:46AM (#11980538)
This have been an annoyance in many DBMS-engines, I have previously solved it with recompiles, either triggered or nightly/hourly.
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by jldugger on Sunday June 26, 2016 @02:12PM (#11981874)
> It's worth noting that 9.1 is still the version in Ubuntu 12.04, it's only 14.04 that has 9.3.

And the most recent LTS, 16.04, has 9.5.

[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by raverbashing on Sunday June 26, 2016 @05:59AM (#11980093)
In which case different values would end up have a different query plan? NULL values?
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by sixbrx on Sunday June 26, 2016 @11:37AM (#11981213)
That's one of the main points of gathering statistics, so the query plan can depend on the values being queried. At least in Oracle, not sure about Postgres. For long running queries it can be a big win.
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by greenleafjacob on Sunday June 26, 2016 @06:54PM (#11983201)
Here is an example [1] that just is a simple equality comparison on an indexed column falling back to a sequential table scan.

[1] http://blog.endpoint.com/2014/04/custom-plans-prepared-state...

[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by ComodoHacker on Sunday June 26, 2016 @06:02AM (#11980104)
Skewed distribution.
[ Parent | on HN ]