Received: from localhost (unknown [200.46.208.211]) by mail.postgresql.org (Postfix) with ESMTP id 977AD633089 for ; Mon, 19 Oct 2009 19:55:51 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024) with ESMTP id 04565-04 for ; Mon, 19 Oct 2009 22:55:34 +0000 (UTC) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by mail.postgresql.org (Postfix) with ESMTP id AF9E7632B40 for ; Mon, 19 Oct 2009 19:55:40 -0300 (ADT) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.14.2/8.14.2) with ESMTP id n9JMtchx013152; Mon, 19 Oct 2009 18:55:38 -0400 (EDT) To: Andrew Hall cc: pgsql-sql@postgresql.org Subject: Re: Dynamic Query In-reply-to: References: Comments: In-reply-to Andrew Hall message dated "Mon, 19 Oct 2009 22:39:35 -0000" Date: Mon, 19 Oct 2009 18:55:38 -0400 Message-ID: <13151.1255992938@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-1.364 tagged_above=-10 required=5 tests=AWL=-1.179, BAYES_40=-0.185 X-Spam-Level: X-Archive-Number: 200910/74 X-Sequence-Number: 33273 Andrew Hall writes: > Is there a recommended way to translate this function into plpgSQL which would protect me from SQL Injection (most important for me) and use bind variables (of secondary importance? See quote_literal() and/or quote_nullable(). On the whole though I think you'd be best off not using a dynamically-constructed query at all --- given the desired %'s in the LIKE pattern, there is not going to be any benefit at all from using an unparameterized query. Just write it out without all the string-construction. regards, tom lane