From: Pavel Stehule <pavel.stehule@gmail.com>
To: A. Kretschmer <andreas.kretschmer@schollglas.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Selecting values from comma separated string
Date: Wed, 26 Aug 2009 15:33:11 +0200
Message-ID: <162867790908260633l5245f689v88691a08968b4ab0@mail.gmail.com> (raw)
In-Reply-To: <20090826133036.GK32599@a-kretschmer.de>
References: <f16f7ea00908260619t59555d37u66bebfe47132304f@mail.gmail.com>
<20090826133036.GK32599@a-kretschmer.de>
2009/8/26 A. Kretschmer <andreas.kretschmer@schollglas.com>:
> In response to Nacef LABIDI :
>> Hi all,
>>
>> I want to write a function that takes as param a comma separated values string
>> and perform a select matching these values.
>>
>> Here is the string '1,3,7,8'
>>
>> And I wan to perform a : SELECT * FROM my_table WHERE id IN (1, 3, 7, 8);
>
> Use EXECUTE sql_string, see
> http://www.postgresql.org/docs/8.4/interactive/plpgsql-control-structures.html
>
> For instance, simple example, untested:
>
Hello
> create function foo (my_string) returns setof record as $$
> declare
> sql text;
> begin
> sql:='SELECT * FROM my_table WHERE id IN (' || $1 || ')';
> return query execute sql;
> end;
>
It's dangerous solution - there can be sql injection attack
regards
Pavel Stehule
> The variable sql contains the whole query, and then execute that.
>
> HTH, Andreas
> --
> Andreas Kretschmer
> Kontakt: Heynitz: 035242/47150, D1: 0160/7141639 (mehr: -> Header)
> GnuPG-ID: 0x3FFF606C, privat 0x7F4584DA http://wwwkeys.de.pgp.net
>
> --
> Sent via pgsql-sql mailing list (pgsql-sql@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-sql
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: pavel.stehule@gmail.com, andreas.kretschmer@schollglas.com
Subject: Re: Selecting values from comma separated string
In-Reply-To: <162867790908260633l5245f689v88691a08968b4ab0@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox