On: Using Multi-Byte Characters to Nullify SQL Injecti...

[raverbashing]

In which case different values would end up have a different query plan? NULL values?

[sixbrx → raverbashing]

That's one of the main points of gathering statistics, so the query plan can depend on the values being queried. At least in Oracle, not sure about Postgres. For long running queries it can be a big win.

[greenleafjacob → raverbashing]

Here is an example [1] that just is a simple equality comparison on an indexed column falling back to a sequential table scan.

[1] http://blog.endpoint.com/2014/04/custom-plans-prepared-state...

[ComodoHacker → raverbashing]

Skewed distribution.