News for hackers. Stuff that matters.
Re:Finding an authorization bypass on my own website by hn_throwaway_99 on Sunday March 06, 2022 @10:58AM (#30578387)
> This generally requires one call to prepare the statement and fetch some sort of handle, and then executing the statement with the handle from the first call.

Not always. The Node `pg` module pipelines down the commands on the connection: it sends a `prepare` command, then a `bind` command, then an `execute` command. Yes, it uses prepared statements under the hood, but there is no wire round trip between prepare and bind.

Re:Finding an authorization bypass on my own website by tomnipotent on Sunday March 06, 2022 @06:42PM (#30582414)
Looks like Postgres 14 added pipeline mode in libpq, good to know!