Re: [HACKERS] No parameters support in create user?

2004-09-21 Thread Shachar Shemesh
Gaetano Mendola wrote: Shachar Shemesh wrote: Tom Lane wrote: Parameters are only supported in plannable statements (SELECT/INSERT/UPDATE/DELETE; I think there is some hack for DECLARE CURSOR these days too). That's a shame. Aside from executing prepared statements, parameters are also useful

[HACKERS] No parameters support in create user?

2004-09-20 Thread Shachar Shemesh
Hi list, When I try to create a user using the create user SQL command, where the command is being executed using the PQexecParams function from libpq, and the username and password are passed as text (oid 0x19) parameters (binary), I get a syntax error. The command I'm doing is: create user

Re: [HACKERS] No parameters support in create user?

2004-09-20 Thread Tom Lane
Shachar Shemesh [EMAIL PROTECTED] writes: create user $1 with encrypted password $2 Any idea why this is not working? Parameters are only supported in plannable statements (SELECT/INSERT/UPDATE/DELETE; I think there is some hack for DECLARE CURSOR these days too).

Re: [HACKERS] No parameters support in create user?

2004-09-20 Thread Shachar Shemesh
Tom Lane wrote: Parameters are only supported in plannable statements (SELECT/INSERT/UPDATE/DELETE; I think there is some hack for DECLARE CURSOR these days too). That's a shame. Aside from executing prepared statements, parameters are also useful for preventing SQL injections. Under those

Re: [HACKERS] No parameters support in create user?

2004-09-20 Thread Tom Lane
Shachar Shemesh [EMAIL PROTECTED] writes: Tom Lane wrote: Parameters are only supported in plannable statements (SELECT/INSERT/UPDATE/DELETE; I think there is some hack for DECLARE CURSOR these days too). That's a shame. Aside from executing prepared statements, parameters are also useful

Re: [HACKERS] No parameters support in create user?

2004-09-20 Thread Gaetano Mendola
Shachar Shemesh wrote: Tom Lane wrote: Parameters are only supported in plannable statements (SELECT/INSERT/UPDATE/DELETE; I think there is some hack for DECLARE CURSOR these days too). That's a shame. Aside from executing prepared statements, parameters are also useful for preventing SQL