Skip site navigation (1) Skip section navigation (2)

Re: function to escape single quotes

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Saranya Sivakumar <sarlavk(at)yahoo(dot)com>
Cc: pgsqlnovice <pgsql-novice(at)postgresql(dot)org>
Subject: Re: function to escape single quotes
Date: 2005-08-24 15:13:59
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-novice
Saranya Sivakumar <sarlavk(at)yahoo(dot)com> writes:
> I would like to write a PL/PGSQL function that would escape any
> occurence of single quotes in a string, and call this function before
> inserting the unescaped strings into some tables. Is this a good
> approach to make sure all strings are escaped before inserting into
> tables?

By the time the data gets to a pl/pgsql function, the damage (if any)
would already have been done.  You pretty much have to deal with this
issue on the client application side.

BTW there already are such functions available, you need not write your
own --- see quote_literal().  About the only context in which this is
needed in plpgsql is constructing dynamic query strings for use in

			regards, tom lane

In response to

pgsql-novice by date

Next:From: cbradenDate: 2005-08-24 16:22:23
Subject: SQL problem?
Previous:From: Saranya SivakumarDate: 2005-08-24 13:39:41
Subject: function to escape single quotes

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group