Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I just found the following function in two RDS PostgreSQL 9.3 DBs:

-- Name: exec(text); Type: FUNCTION; Schema: public; Owner: adam

    LANGUAGE plpgsql
    AS $_$ BEGIN EXECUTE $1; RETURN $1; END; $_$;

ALTER FUNCTION public.exec(text) OWNER TO adam;

I am pretty sure I did not write this function, and since exec seems like a security hazard (does it simply execute commands?) It would like to know what is it all about. Searching the method signature didn't help me.

What does this function do?
Is it a security risk of some sort?
Which program/framework might have created it?

share|improve this question
"What does this function do?" -… – a_horse_with_no_name Aug 13 '14 at 11:40
@a_horse_with_no_name thanks. – Adam Matan Aug 13 '14 at 14:07
up vote 4 down vote accepted

It's a totally pointless function that executes arbitrary SQL. It isn't SECURITY DEFINER so the only risk I think it can pose is if you allow users to run arbitrary SQL predicates or call arbitrary functions (in which case you're probably already stuffed) but try to block them from running any command they want.

As you guessed, it just executes the SQL input using PL/PgSQL's dynamic SQL facilities.

Oh, it'd also hide the statement text from simple log_statement analysis, auto_explain etc, as they only look at top level statements, not statements run via PL/pgSQL.

Personally I'd drop/rename it, and see what complains.

share|improve this answer
Thanks a lot for the answer. Have you ever encountered a spontaneous creation of this function? – Adam Matan Aug 13 '14 at 14:07
No. Something, or someone, created it. If you keep log_statement = 'all' logs far enough back you might be able to find out more. – Craig Ringer Aug 13 '14 at 15:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.