Tag Info

New answers tagged

0

The correct solution is not to try concatenating quotes around the argument. That is a very naive approach, and leads to SQL injection vulnerabilities. The QUOTE() function solves this, when it's needed. However, you do not need these things to be quoted at all in the queries you're running. Worse, adding literal quotes to these values is likely to get ...


0

This finally worked DELIMITER // CREATE PROCEDURE ja_logan_proc() BEGIN SELECT id, dest_msisdn, text_message INTO @the_id, @the_number, @the_message FROM incoming_sms where job_status = 0 AND text_message LIKE '%logan%' order by rand() limit 1; if((select search_number_in_r4(CONCAT('`',@the_number,'`'))) = 'true')then call ...


2

Based on a simple test case I just wrote: @Test public void test() throws SQLException { PreparedStatement ps = conn.prepareStatement("SET ROLE ?"); ps.setString(1, "someuser"); ps.executeUpdate(); } I think the error you refer to is probably: org.postgresql.util.PSQLException: ERROR: syntax error at or near "$1" Position: 10 at ...


2

You could create a function that executes SET ROLE with dynamic SQL, using format to safely insert the role identifier (%I inserts an identifier, placing double quotes around it if necessary, and escaping double quotes in the string by doubling them up if necessary). Something along the lines of CREATE FUNCTION setrole(role text) RETURNS void AS $$ BEGIN ...



Top 50 recent answers are included