From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andrew Hall <andrewah@hotmail.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Dynamic Query
Date: Mon, 19 Oct 2009 18:55:38 -0400
Message-ID: <13151.1255992938@sss.pgh.pa.us> (raw)
In-Reply-To: <COL122-W444106E22A0210DFFB5554CDC10@phx.gbl>
References: <COL122-W444106E22A0210DFFB5554CDC10@phx.gbl>
Andrew Hall <andrewah@hotmail.com> writes:
> Is there a recommended way to translate this function into plpgSQL which would protect me from SQL Injection (most important for me) and use bind variables (of secondary importance?
See quote_literal() and/or quote_nullable(). On the whole though I
think you'd be best off not using a dynamically-constructed query at
all --- given the desired %'s in the LIKE pattern, there is not going
to be any benefit at all from using an unparameterized query. Just
write it out without all the string-construction.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, andrewah@hotmail.com
Subject: Re: Dynamic Query
In-Reply-To: <13151.1255992938@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox