I really really like this creation of yours, and I've already learned a couple things from it. However, you really really need to be careful about SQL injectio

I really really like this creation of yours, and I've already learned a couple things from it. However, you really really need to be careful about SQL injection. I can see that you tried to lock it down as much as possible, as far as I can tell the account the queries are running under only has SELECT permission (no update/delete/etc). However I was still able to get some data you probably don't want me to have... This query returns a list of all tables in your database: SELECT c.relname||'' FROM pg_catalog.pg_class c LEFT JOIN pg_catalog.pg_namespace n ON n.oid = c.relnamespace And this query returns a list of users and their privileges: SELECT usename||'', usecreatedb||'', usesuper||'', usecatupd||'' FROM pg_user I guess your name is Andy based on your HN username, but who is Rusty? :) And that's just what I've been able to get in 5 minutes of trying, let alone a determined attacker.