0

Can I have another function to return the last timestamp. I want to compare with this query to use the best query.

My query:

CREATE OR REPLACE FUNCTION f_last_update1(nomTable text , OUT updated timestamp)
  LANGUAGE plpgsql AS
$func$
BEGIN
   EXECUTE 'SELECT max(updated) FROM ' || nomTable
   INTO updated;   
END
$func$; 
0

1 Answer 1

0

Your function is insecure and vulnerable to SQL injection:

SELECT f_last_update1('sometable; DROP TABLE sometable; SELECT current_timestamp');

Use

CREATE OR REPLACE FUNCTION f_last_update1(
   IN  nomSchema text,
   IN  nomTable text,
   OUT updated timestamp)
  LANGUAGE plpgsql AS
$func$
BEGIN
   EXECUTE format(
              'SELECT max(updated) FROM %I.%I',
              nomSchema,
              nomTable
           )
      INTO updated;
END
$func$;
5
  • how can i add schema Commented Apr 9, 2021 at 10:33
  • Like I show in my extended answer. Commented Apr 9, 2021 at 10:56
  • i get error see query : dbfiddle.uk/… Commented Apr 9, 2021 at 11:06
  • Well, if the function has two input parameters, you have to call it with two arguments... Commented Apr 9, 2021 at 11:08
  • 1
    @FranckWhite: My answer to your duplicate question yesterday avoids all of these complications by using regclass input. Commented Apr 9, 2021 at 14:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.