Re: DDL+SQL in PL/pgSQL EXECUTE

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Vlad Arkhipov <arhipov(at)dc(dot)baikal(dot)ru>
Cc: pgsql-hackers(at)postgresql(dot)org
Subject: Re: DDL+SQL in PL/pgSQL EXECUTE
Date: 2009-03-18 12:48:28
Message-ID: 8495.1237380508@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Vlad Arkhipov <arhipov(at)dc(dot)baikal(dot)ru> writes:
> 3. ERROR: relation "t" does not exist
> SELECT _EXEC('CREATE TABLE T(ID INTEGER); INSERT INTO T(ID) VALUES (1)');

> 4. Inserts NULL value into ID column instead of default 10.
> BEGIN WORK;
> CREATE TABLE T(ID INTEGER);
> SELECT _EXEC('ALTER TABLE T ALTER COLUMN ID SET DEFAULT(10); INSERT INTO
> T DEFAULT VALUES');

Commands submitted in a single string are typically parsed and planned
before they are executed (though the behavior probably depends on
context and which PG version you're talking about). My advice is
don't do that.

If we were to do anything about it, it'd probably be to ban
multi-statement EXECUTE on security grounds ...

regards, tom lane

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Alvaro Herrera 2009-03-18 13:49:27 Re: gettext, plural form and translation
Previous Message Tom Lane 2009-03-18 12:35:55 cs_CZ vs regression tests, part N