Re: quoting and EXECUTE in plpgsql function - Mailing list pgsql-general

From Tom Lane
Subject Re: quoting and EXECUTE in plpgsql function
Date
Msg-id 25733.1036377544@sss.pgh.pa.us
Whole thread Raw
In response to quoting and EXECUTE in plpgsql function  ("Matthew Nuzum" <cobalt@bearfruit.org>)
List pgsql-general
"Matthew Nuzum" <cobalt@bearfruit.org> writes:
> EXECUTE '' INSERT INTO raw_data '' ||
> ''
> (vhost,host,date,path,method,protocol,status,size,referrer,user_agent)
> '' ||
> '' VALUES ('' ||
> quote_ident(vhost) || '', '' ||quote_ident(host) || '', '' ||
> quote_ident(date) || '', '' ||
> quote_ident(path) || '', '' || quote_ident(method) || '', '' ||
> quote_ident(protocol) || '', '' || status || '', '' || size || '', '' ||
> quote_ident(referer)  || '', '' || quote_ident(user_agent) ||
> '');'';

I believe you want quote_literal, not quote_ident, in all these cases.
quote_ident would be used if you want to use the contents of the plpgsql
variable as a *name* in the resulting SQL statement; but you want to use
it as a literal constant, AFAICT.

But actually, this seems like the most painful and least efficient way
you could choose to do it.  Do you really need an EXECUTE?  I'd be
inclined to write just

INSERT INTO raw_data
(vhost,host,date,path,method,protocol,status,size,referrer,user_agent)
VALUES (vhost_parm, host_parm, ...);

Note that when doing it that way, you *must* choose plpgsql variable
names that don't conflict with the table column names; plpgsql is not
smart enough to understand that in
    INSERT INTO raw_data (vhost, ...) VALUES(vhost, ...);
you'd like it to substitute for the second "vhost" and not the first.

            regards, tom lane

pgsql-general by date:

Previous
From: Doug McNaught
Date:
Subject: Re: quoting and EXECUTE in plpgsql function
Next
From: Benjamin Scherrey
Date:
Subject: Re: Changing max size of attribute names.