Sometimes the third time is the charm. Third try to fix the sql injection

vulnerability.  This fix completely removes the ability (hack) of being able
to bind a list of values in an in clause.  It was demonstrated that by allowing
that functionality you open up the possibility for certain types of
sql injection attacks.  The previous fix attempts all focused on preventing
the insertion of additional sql statements (the semi-colon problem:
xxx; any new sql statement here).  But that still left the ability to
change the where clause on the current statement or perform a subselect
which can circumvent applicaiton security logic and/or allow you to call
any stored function.

 Modified Files:
 	jdbc/org/postgresql/jdbc1/AbstractJdbc1Statement.java

0 files changed, 0 insertions, 0 deletions