> People have been struggling with securing against SQL injection attacks for decades.
Parameterized queries.
A decades old struggle is now lifted from you. Go in peace, my son.
Parameterized queries.
A decades old struggle is now lifted from you. Go in peace, my son.
Also happy to be wrong, but in Postges clients, parametrized queries are usually implemented via prepared statements, which do not work with DDL on the protocol level. This means that if you want to create a role or table which name is a user input, you have a bad time. At least I wasn’t able to find a way to escape DDL parameters with rust-postgres, for example.
And because this seems to be a protocol limitation, I guess the clients that do implement it, do it in some custom way on the client side.
The problem is that solutions don't exist, rather the lack of safety culture that keeps ignoring best practices unless they are imposed by regulations.
you meant "problem ISN'T that solutions...", right?