Functions, triggers and row-level security policies allow
users to insert code into the backend server that other users
might execute unintentionally. Hence, these mechanisms permit
users to “Trojan
horse” others with relative ease. The strongest
protection is tight control over who can define objects. Where
that is infeasible, write queries referring only to objects
having trusted owners. Remove from
search_path the public schema and any other
schemas that permit untrusted users to create objects.
Functions run inside the backend server process with the operating system permissions of the database server daemon. If the programming language used for the function allows unchecked memory accesses, it is possible to change the server's internal data structures. Hence, among many other things, such functions can circumvent any system access controls. Function languages that allow such access are considered “untrusted”, and PostgreSQL allows only superusers to create functions written in those languages.
If you see anything in the documentation that is not correct, does not match your experience with the particular feature or requires further clarification, please use this form to report a documentation issue.