Received: from localhost (unknown [200.46.208.211]) by mail.postgresql.org (Postfix) with ESMTP id 350B5632A6B for ; Wed, 26 Aug 2009 10:34:02 -0300 (ADT) Received: from mail.postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024) with ESMTP id 13165-07 for ; Wed, 26 Aug 2009 13:33:32 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-yw0-f202.google.com (mail-yw0-f202.google.com [209.85.211.202]) by mail.postgresql.org (Postfix) with ESMTP id CC73E633F69 for ; Wed, 26 Aug 2009 10:33:12 -0300 (ADT) Received: by ywh40 with SMTP id 40so206310ywh.14 for ; Wed, 26 Aug 2009 06:33:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:in-reply-to:references :date:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=qsLDFyFanuy8jBcdpXCtxllF88Wh7SuhJKKIxvYCa3s=; b=VOkRmXa5pEfPg/+yzbukz//gwI0NX0rKXqEQaYs5skReF7hVhaT/N9XVPkfQRoi4LA vvZ7EZso85nttXWhOI0juoAeJLe4i+e8N/6Muqnn3DFeoBi/YF++IBzQJJuwu4JxUSfi XcEHFBczNcbU5XMshs9fbRTCM/vHVp6q6g6yU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:content-transfer-encoding; b=ATgFlUfh4HBrItvOQXIU8MTxAfb79owq7yZlaxTJvHPQZID2MRq9jakwdiGplmrXMi 8u0k3CJnyseqBAJ+FC/2a5rKLg+iDQjygRzA977/MwC6CSwfeAIcSaABgTXoPwCqHJCu so1DvqG7LYMxjgfh53k2u88SjzTcUPO6JLwN8= MIME-Version: 1.0 Received: by 10.150.32.1 with SMTP id f1mr13045866ybf.96.1251293591344; Wed, 26 Aug 2009 06:33:11 -0700 (PDT) In-Reply-To: <20090826133036.GK32599@a-kretschmer.de> References: <20090826133036.GK32599@a-kretschmer.de> Date: Wed, 26 Aug 2009 15:33:11 +0200 Message-ID: <162867790908260633l5245f689v88691a08968b4ab0@mail.gmail.com> Subject: Re: Selecting values from comma separated string From: Pavel Stehule To: "A. Kretschmer" Cc: pgsql-sql@postgresql.org Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Virus-Scanned: Maia Mailguard 1.0.1 X-Spam-Status: No, hits=-2.535 tagged_above=-10 required=5 tests=AWL=0.064, BAYES_00=-2.599 X-Spam-Level: X-Archive-Number: 200908/130 X-Sequence-Number: 33039 2009/8/26 A. Kretschmer : > In response to Nacef LABIDI : >> Hi all, >> >> I want to write a function that takes as param a comma separated values = string >> and perform a select matching these values. >> >> Here is the string '1,3,7,8' >> >> And I wan to perform a : SELECT * FROM my_table WHERE id IN (1, 3, 7, 8)= ; > > Use EXECUTE sql_string, see > http://www.postgresql.org/docs/8.4/interactive/plpgsql-control-structures= .html > > For instance, simple example, untested: > Hello > create function foo (my_string) returns setof record as $$ > declare > =C2=A0sql text; > begin > =C2=A0sql:=3D'SELECT * FROM my_table WHERE id IN (' || $1 || ')'; > =C2=A0return query execute sql; > end; > It's dangerous solution - there can be sql injection attack regards Pavel Stehule > The variable sql contains the whole query, and then execute that. > > HTH, Andreas > -- > Andreas Kretschmer > Kontakt: =C2=A0Heynitz: 035242/47150, =C2=A0 D1: 0160/7141639 (mehr: -> H= eader) > GnuPG-ID: =C2=A0 0x3FFF606C, privat 0x7F4584DA =C2=A0 http://wwwkeys.de.p= gp.net > > -- > Sent via pgsql-sql mailing list (pgsql-sql@postgresql.org) > To make changes to your subscription: > http://www.postgresql.org/mailpref/pgsql-sql >