Add:

> 	o Consider parsing the -c string into individual queries so each
> 	  is run in its own transaction
>
> 	o Consider disallowing multiple queries in PQexec() as an
> 	  additional barrier to SQL injection attacks

diff --git a/doc/TODO b/doc/TODO
index 5661f187285bde2b584428833c25a4db27108de0..f5e1ea472ddd5e5eb4b7a9513947321fef96b040 100644 (file)
--- a/doc/TODO
+++ b/doc/TODO
@@ -2,7 +2,7 @@
 PostgreSQL TODO List
 ====================
 Current maintainer:    Bruce Momjian ([email protected])
-Last updated:      Sat Jan  6 15:00:41 EST 2007
+Last updated:      Sat Jan  6 16:33:48 EST 2007
 
 The most recent version of this document can be viewed at
 http://www.postgresql.org/docs/faqs.TODO.html.
@@ -738,6 +738,9 @@ Clients
      because setting the transaction isolation level must be the
      first statement of a transaction.
 
+   o Consider parsing the -c string into individual queries so each
+     is run in its own transaction
+
 
 * pg_dump
 
@@ -795,8 +798,10 @@ Clients
      held on the server waiting for them to be requested by libpq.
      One complexity is that a statement like SELECT 1/col could error
      out mid-way through the result set.
-   * Fix SSL retry to avoid useless repeated connection attempts and
+   o Fix SSL retry to avoid useless repeated connection attempts and
      ensuing misleading error messages
+   o Consider disallowing multiple queries in PQexec() as an
+     additional barrier to SQL injection attacks
 
 
 Triggers

diff --git a/doc/src/FAQ/TODO.html b/doc/src/FAQ/TODO.html
index 0f0c98f4d919ab6fc5adff0d40fd46f27ab04639..4d1a64da60f1666a95a31ddeb72e454ca411ba34 100644 (file)
--- a/doc/src/FAQ/TODO.html
+++ b/doc/src/FAQ/TODO.html
@@ -8,7 +8,7 @@
 
 PostgreSQL TODO List
 Current maintainer:     Bruce Momjian ([email protected])
-Last updated:           Sat Jan  6 15:00:41 EST 2007
+Last updated:           Sat Jan  6 16:33:48 EST 2007
 
 The most recent version of this document can be viewed at
 http://www.postgresql.org/docs/faqs.TODO.html.
@@ -669,6 +669,8 @@ first.
           because setting the transaction isolation level must be the
           first statement of a transaction.
 
+    Consider parsing the -c string into individual queries so each
+          is run in its own transaction
   
   pg_dump
   
@@ -721,12 +723,12 @@ first.
           held on the server waiting for them to be requested by libpq.
           One complexity is that a statement like SELECT 1/col could error
           out mid-way through the result set.
-    
-      Fix SSL retry to avoid useless repeated connection attempts and
+    Fix SSL retry to avoid useless repeated connection attempts and
           ensuing misleading error messages
-    
+    Consider disallowing multiple queries in PQexec() as an
+          additional barrier to SQL injection attacks
   
-li>
+p>
 Triggers
 
 
@@ -1298,6 +1300,6 @@ first.
   Teodor is Teodor Sigaev <[email protected]>
   Tom is Tom Lane <[email protected]> of Red Hat
 
-
+