Mastering PostgreSQL 12 - Third Edition

Escaping in PL/Perl and support functions

So far, we have only used integers, so SQL injection or special table names were not an issue. Basically, the following functions are available:

• quote_literal: This returns a string quote as a string literal.
• quote_nullable: This quotes a string.
• quote_ident: This quotes SQL identifiers (object names, and so on).
• decode_bytea: This decodes a PostgreSQL byte array field.
• encode_bytea: This encodes data, and turns it into a byte array.
• encode_literal_array: This encodes an array of literals.
• encode_typed_literal: This converts a Perl variable into the value of the data type that's passed as a second argument, and returns a string representation of this value.
• encode_array_constructor: This returns ...