to escape or not to

From: "Jean-Yves F(dot) Barbier" <12ukwn(at)gmail(dot)com>
To: pgsql-novice(at)postgresql(dot)org
Subject: to escape or not to
Date: 2011-06-22 13:49:07
Message-ID: 20110622154907.621ed4e1@anubis.defcon1
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-novice

Hi list,

As of '39.5: plpgsql-statements', it is said that using '$n' instead of a named
variable is prefered and less sensitive to a SQL injection.

Does it really mean if I use $n I don't have to 'quote_xxxxxx' any of these
variables?

JY
--
The 80's -- when you can't tell hairstyles from chemotherapy.

Responses

Browse pgsql-novice by date

  From Date Subject
Next Message Jean-Yves F. Barbier 2011-06-22 13:53:56 change to session_user in a security definer function
Previous Message Leon Starr 2011-06-22 04:13:03 How to trap error: nextval: reached maximum value of sequence