Re: How does one make the following psql statement sql-injection resilient?

On Mon, Mar 16, 2015 at 9:31 PM, David G. Johnston <
david(dot)g(dot)johnston(at)gmail(dot)com> wrote:

> On Monday, March 16, 2015, Alvaro Herrera <alvherre(at)2ndquadrant(dot)com>
> wrote:
>
>> David G. Johnston wrote:
>>
>> > Thanks! I got the gist even with the typo. I actually pondered about
>> > prepare/execute after hitting send. Am I correct in remembering that
>> > "CREATE TEMP TABLE" cannot be prepared? I was using the actual query
>> with
>> > CREATE TEMP TABLE and then issuing "\copy" to dump the result out to the
>> > file. The limitation of copy to having to be written on a single line
>> > makes the intermediary temporary table seem almost a necessity.
>>
>> CREATE TEMP TABLE AS EXECUTE
>>
>>
> Thanks.
>
> Though unless I need to work on the temp table I think:
>
> PREPARE ...;
> \copy (EXECUTE ...) TO '~/temp.csv' ...;
>
> Gives the best of all worlds.
>
>
​Except that server "COPY" only is documented to accept a "query" that
begins with either SELECT or VALUES :(

I hereby voice my desire for EXECUTE to be usable as well.

David J.​