Re: Having trouble passing a shell variable to a query from psql command line - Mailing list pgsql-admin

From Ron Johnson
Subject Re: Having trouble passing a shell variable to a query from psql command line
Date
Msg-id CANzqJaCuEFz19dTB53iwiW0vDp1yHrkX8P_1bSyKPyoL8vQ+GQ@mail.gmail.com
Whole thread Raw
In response to Re: Having trouble passing a shell variable to a query from psql command line  (Tom Lane <tgl@sss.pgh.pa.us>)
List pgsql-admin
On Fri, Aug 29, 2025 at 3:15 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
Ron Johnson <ronljohnsonjr@gmail.com> writes:
> Yeah.  From the cli KISS and do regular bash variable string expansion.

> psql -d mydb -tAc "SELECT relkind FROM pg_class WHERE relname =
> ${SHELL_VAR} ;"

This isn't a great recommendation because bash is not aware of
SQL's quoting rules.  It'll work in simple cases, but there's
a risk of SQL injection if the value of SHELL_VAR comes from
an untrustworthy source.

Well, yeah, if your shell script interacts with the outside world you've got to be a bit more robust than if the script only does db maintenance operations on the db server. 

--
Death to <Redacted>, and butter sauce.
Don't boil me, I'm still alive.
<Redacted> lobster!

pgsql-admin by date:

Previous
From: Ron Johnson
Date:
Subject: Why might autovacuum not be analyzing chk_image_rp4_y2025m08?
Next
From: Murthy Nunna
Date:
Subject: Query Spins