How to Secure Your PostgreSQL App

1. Use Parameterized Queries

Never concatenate user input into SQL. Use parameterized queries to prevent SQL injection.

// Bad: vulnerable to injection
SELECT * FROM users WHERE email = '${email}'

// Good: parameterized
SELECT * FROM users WHERE email = $1

2. Create Limited-Privilege Roles

Don't connect applications as superuser. Create roles with minimum required permissions.

CREATE ROLE app_user WITH LOGIN PASSWORD 'strong_pwd';
GRANT SELECT, INSERT, UPDATE ON users TO app_user;

3. Enable SSL Connections

Encrypt all database connections with SSL.

# Connection string with SSL
postgres://user:pass@host:5432/db?sslmode=require

4. Configure pg_hba.conf

Restrict which hosts can connect and what authentication they use.

# pg_hba.conf - require SSL and password
hostssl all all 0.0.0.0/0 scram-sha-256

5. Enable Row Level Security

For multi-tenant apps, use RLS to isolate data at the database level.

ALTER TABLE data ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation ON data
  USING (tenant_id = current_setting('app.tenant_id'));

6. Monitor and Audit

Enable logging for access auditing. Monitor for suspicious query patterns.