In Postgres, are prepared queries and user defined functions equivalent as a mechanism for guarding against SQL injection?
Are there particular advantages in one approach over the other?
With SQL functions (
With PL/pgSQL functions (
If parameters should be treated as values or plain text in dynamic SQL with
If parameters should be treated as identifiers, properly sanitize them with one of these tools:
Never just build a string from user input and execute. (This includes identifiers, which have to be treated like user input when building dynamic SQL!)
More about implications on performance in this related answer:
Basics on SQL-injection:
Similar considerations may apply to other server-side languages that allow dynamic SQL.