PostgreSQL Security Features: Episode 6 - SQL Injection Attacks

An SQL #injection attack is an attempt to compromise a database by running SQL statements that provide clues to the attacker as to the content, structure, or #security of the #database. An SQL injection attack can also result in data theft or #data corruption.

Preventing an injection attack is normally the responsibility of the application #developer. Database #administrators typically have little or no control over that potential threat.

The standard method to prevent SQL injection attacks in #PostgreSQL is to use parameterized queries. If you are using #EDB #Postgres Advanced Server, we recommend you use the SQL/Protect module to safeguard against injection attacks. SQL/Protect examines the incoming queries for common attack vectors. This provides an additional layer of security.

#SQL/Protect can alert the administrator to potentially dangerous queries and if desired, it can block these queries.

Use #Postgres - Get stuff done!