Skip to main content
typos
Source Link
Erwin Brandstetter
  • 182.2k
  • 28
  • 457
  • 620

UserUse \set to set set a variable inside psql.
Read about SQL interpolation in the manual here:

Ideally, your script would read:

SELECT * FROM :"my_schema".:"my_table" LIMIT 1;

With schema and table double-quoted separately, for identifier-interpolation. Then set schema and table in psql without quotes like:

my_db=>\set my_schema core
my_db=>\set my_table product

Just the bare, case-sensitive names. Finally, execute:

my_db=>\i my-script.sql

This way, the script is safe against SQL injection.

User \set to set set a variable inside psql.
Read about SQL interpolation in the manual here:

Ideally, your script would read:

SELECT * FROM :"my_schema".:"my_table" LIMIT 1;

With schema and table double-quoted separately, for identifier-interpolation. Then set schema and table in psql without quotes like:

my_db=>\set my_schema core
my_db=>\set my_table product

Just the bare, case-sensitive names. Finally, execute:

my_db=>\i my-script.sql

This way, the script is safe against SQL injection.

Use \set to set a variable inside psql.
Read about SQL interpolation in the manual here:

Ideally, your script would read:

SELECT * FROM :"my_schema".:"my_table" LIMIT 1;

With schema and table double-quoted separately, for identifier-interpolation. Then set schema and table in psql without quotes like:

my_db=>\set my_schema core
my_db=>\set my_table product

Just the bare, case-sensitive names. Finally, execute:

my_db=>\i my-script.sql

This way, the script is safe against SQL injection.

Source Link
Erwin Brandstetter
  • 182.2k
  • 28
  • 457
  • 620

User \set to set set a variable inside psql.
Read about SQL interpolation in the manual here:

Ideally, your script would read:

SELECT * FROM :"my_schema".:"my_table" LIMIT 1;

With schema and table double-quoted separately, for identifier-interpolation. Then set schema and table in psql without quotes like:

my_db=>\set my_schema core
my_db=>\set my_table product

Just the bare, case-sensitive names. Finally, execute:

my_db=>\i my-script.sql

This way, the script is safe against SQL injection.