Skip site navigation (1) Skip section navigation (2)

Re: function to escape single quotes

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Saranya Sivakumar <sarlavk(at)yahoo(dot)com>
Cc: pgsqlnovice <pgsql-novice(at)postgresql(dot)org>
Subject: Re: function to escape single quotes
Date: 2005-08-24 15:13:59
Message-ID: 26096.1124896439@sss.pgh.pa.us (view raw or flat)
Thread:
Lists: pgsql-novice
Saranya Sivakumar <sarlavk(at)yahoo(dot)com> writes:
> I would like to write a PL/PGSQL function that would escape any
> occurence of single quotes in a string, and call this function before
> inserting the unescaped strings into some tables. Is this a good
> approach to make sure all strings are escaped before inserting into
> tables?

By the time the data gets to a pl/pgsql function, the damage (if any)
would already have been done.  You pretty much have to deal with this
issue on the client application side.

BTW there already are such functions available, you need not write your
own --- see quote_literal().  About the only context in which this is
needed in plpgsql is constructing dynamic query strings for use in
EXECUTE.

			regards, tom lane

In response to

pgsql-novice by date

Next:From: cbradenDate: 2005-08-24 16:22:23
Subject: SQL problem?
Previous:From: Saranya SivakumarDate: 2005-08-24 13:39:41
Subject: function to escape single quotes

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group