Re: Fw: Isn't pg_statistic a security hole - Solution Proposal

Peter Eisentraut <peter_e(at)gmx(dot)net> writes:
> Will you expect the function to do dequoting etc. as well? This might get
> out of hand.

Hm. We already have such code available for nextval(), so I suppose
it might be appropriate to invoke that. Not sure. Might be better
to expect the given string to be the correct case already. Let's see
... if you expect the function to be applied to names extracted from
pg_class or other tables, then exact case would be better --- but it'd
be just as easy to invoke the OID form in such cases. For hand-entered
data the nextval convention is probably more convenient.

regards, tom lane