Re: Cross-datatype Comparisons and Indexes

From: "Joshua D(dot) Drake" <jd(at)commandprompt(dot)com>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Bruno Wolff III <bruno(at)wolff(dot)to>, "Thomas F(dot)O'Connell" <tfo(at)sitening(dot)com>, pgsql-general(at)postgresql(dot)org
Subject: Re: Cross-datatype Comparisons and Indexes
Date: 2004-08-20 21:27:59
Message-ID: 41266CDF.4000701@commandprompt.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-general

>
>
> I can think of at least three workarounds in 7.4:
>
> 1. Always quote your constants:
>
> ... WHERE bigintcol = '42';

You can also

WHERE bigintcol = 42::bigint

Sincerely,

Joshua D. Drake

>
> 2. Use a prepared statement:
>
> PREPARE foo(bigint) AS ... WHERE bigintcol = $1;
>
> EXECUTE foo(42);
>
> 3. Use parameterized statements in extended-query mode (essentially the
> same idea as #2, but at the protocol level). This doesn't help for
> pure SQL scripts, but is very workable when coding against libpq or
> JDBC. Among other things it gets you out of worrying about SQL
> injection attacks when your parameter values come from untrusted
> sources.
>
> regards, tom lane
>
> ---------------------------(end of broadcast)---------------------------
> TIP 8: explain analyze is your friend

--
Command Prompt, Inc., home of Mammoth PostgreSQL - S/ODBC and S/JDBC
Postgresql support, programming shared hosting and dedicated hosting.
+1-503-667-4564 - jd(at)commandprompt(dot)com - http://www.commandprompt.com
Mammoth PostgreSQL Replicator. Integrated Replication for PostgreSQL

Attachment Content-Type Size
jd.vcf text/x-vcard 640 bytes

In response to

Browse pgsql-general by date

  From Date Subject
Next Message Mike Mascari 2004-08-20 22:13:08 Re: Cross-datatype Comparisons and Indexes
Previous Message Tom Lane 2004-08-20 21:09:01 Re: Cross-datatype Comparisons and Indexes