A few years ago there was a fellow who gave a presentation at a PostgreSQL user group. He demonstrated an easy to understand way to virtually eliminate sql inj

A few years ago there was a fellow who gave a presentation at a PostgreSQL user group. He demonstrated an easy to understand way to virtually eliminate sql injections attacks. I can't find the paper now but if I recall properly it worked by allowing you to specify a prototype of the kind of statement you want to expand and then checking if the statement being prepared was structurally equivalent to the prototype and then throwing an exception if not. For example if you specify a prototype like select name from emp where {x = 1} then you're telling the system that you want your where clause to have the AST structure {variable operator constant}. Then you let the application generate whatever sql it wants however it wants, e.g. "select name from emp where x = " + $x Then if the database server gets something like "select name from emp where x = x; delete * from emp" The statement doesn't match the structure of the prototype and an error is returned. This allows even a novice to specify the kind of sql they want to allow without having to learn much.