在 Postgres 中,准备好的查询和用户定义的函数是否等同于一种防止 SQL 注入的机制?
一种方法比另一种方法有什么特别的优势吗?
postgresql sql-injection prepared-statement plpgsql functions
我在 PostgreSQL 9.3 中使用了一个 PL/pgSQL 函数,里面有几个复杂的查询:
create function f1()
returns integer as
$$
declare
event tablename%ROWTYPE;
....
....
begin
FOR event IN
SELECT * FROM tablename WHERE condition
LOOP
EXECUTE 'SELECT f2(event.columnname)' INTO dummy_return;
END LOOP;
...
INSERT INTO ... FROM a LEFT JOIN b ... LEFT JOIN c WHERE ...
UPDATE T SET cl1 = M.cl1 FROM M WHERE M.pkcols = T.pkcols;
...
end
$$ language plpgsql;
Run Code Online (Sandbox Code Playgroud)
如果我跑了EXPLAIN ANALYZE f1(),我只会得到总时间,但没有细节。有没有办法可以获得函数中所有查询的详细结果?
如果函数中的查询不应该被 Postgres 优化,我也会要求解释。
我正在创建一个临时表,并从多个表中获取数据并将数据插入其中。当我尝试从表中取回数据时,出现错误:
Run Code Online (Sandbox Code Playgroud)[42601] ERROR: query has no destination for result data Hint: If you want to discard the results of a SELECT, use PERFORM instead.
do
$$
DECLARE
sampleproductId varchar;
productIds text[] := array [
'abc1',
'abc2'
];
tId varchar;
DECLARE result jsonb;
DECLARE resultS jsonb[];
begin
CREATE TEMP TABLE IF NOT EXISTS product_temp_mapping
(
accountid int,
productUID varchar,
sampleproductId text
);
FOREACH sampleproductId IN ARRAY productIds
LOOP
tId := (select id
from product.product
where uid = sampleproductId);
INSERT into product_temp_mapping …Run Code Online (Sandbox Code Playgroud) 我将 Postgres 13.3 与内部和外部查询一起使用,它们都只产生一行(只是一些关于行数的统计数据)。
我不明白为什么下面的 Query2 比 Query1 慢得多。它们基本上应该几乎完全相同,最多可能只有几毫秒的差异......
WITH t1 AS (
SELECT
(SELECT COUNT(*) FROM racing.all_computable_xformula_bday_combos) AS all_count,
(SELECT COUNT(*) FROM racing.xday_todo_all) AS todo_count,
(SELECT COUNT(*) FROM racing.xday) AS xday_row_count
OFFSET 0 -- this is to prevent inlining
)
SELECT
t1.all_count,
t1.all_count-t1.todo_count AS done_count,
t1.todo_count,
t1.xday_row_count
FROM t1;
Run Code Online (Sandbox Code Playgroud)
我只添加了一行:
WITH t1 AS (
SELECT
(SELECT COUNT(*) FROM racing.all_computable_xformula_bday_combos) AS all_count,
(SELECT COUNT(*) FROM racing.xday_todo_all) AS todo_count,
(SELECT COUNT(*) …Run Code Online (Sandbox Code Playgroud)