Saranya Sivakumar <sarlavk@yahoo.com> writes:
> I would like to write a PL/PGSQL function that would escape any
> occurence of single quotes in a string, and call this function before
> inserting the unescaped strings into some tables. Is this a good
> approach to make sure all strings are escaped before inserting into
> tables?
By the time the data gets to a pl/pgsql function, the damage (if any)
would already have been done. You pretty much have to deal with this
issue on the client application side.
BTW there already are such functions available, you need not write your
own --- see quote_literal(). About the only context in which this is
needed in plpgsql is constructing dynamic query strings for use in
EXECUTE.
regards, tom lane
