News for hackers. Stuff that matters.

A comment on Using Multi-Byte Characters to Nullify SQL Injection Sanitizing. Parent comment

Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by raverbashing on Sunday June 26, 2016 @05:59AM (#11980093)
In which case different values would end up have a different query plan? NULL values?
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by sixbrx on Sunday June 26, 2016 @11:37AM (#11981213)
That's one of the main points of gathering statistics, so the query plan can depend on the values being queried. At least in Oracle, not sure about Postgres. For long running queries it can be a big win.
[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by greenleafjacob on Sunday June 26, 2016 @06:54PM (#11983201)
Here is an example [1] that just is a simple equality comparison on an indexed column falling back to a sequential table scan.

[1] http://blog.endpoint.com/2014/04/custom-plans-prepared-state...

[ Parent | on HN ]
Re:Using Multi-Byte Characters to Nullify SQL Injection Sani... by ComodoHacker on Sunday June 26, 2016 @06:02AM (#11980104)
Skewed distribution.
[ Parent | on HN ]