PLPGSQL 在函数调用中使用单引号（python）答案

【问题标题】：PLPGSQL using single quotes in function call (python)PLPGSQL 在函数调用中使用单引号（python）
【发布时间】：2010-12-13 23:11:46
【问题描述】：

在 plpgsql 函数的插入值中使用单引号时遇到问题它看起来像这样：

"AND (u.firstname LIKE 'koen') OR (u.firstname LIKE 'dirk')"

这是用python完成的

我试过\'和''和'''和''''和'''''甚至''''''' 他们似乎都没有工作并返回以下错误：

[FAIL][“koen”处或附近的语法错误第 1 行：...'u.firstname', 'ASC', 'AND (u.firstname LIKE 'koe...

感谢任何帮助！

非常感谢！

========================= 编辑====================== ===

对不起！这是我的 plpgsql 函数：

CREATE FUNCTION get_members(IN in_company_uuid uuid, IN in_start integer, IN in_limit integer, IN in_sort character varying, IN in_order character varying, IN in_querystring CHARACTER VARYING, IN in_filterstring CHARACTER VARYING, IN OUT out_status integer, OUT out_status_description character varying, OUT out_value character varying[]) RETURNS record
    LANGUAGE plpgsql
    AS $$DECLARE

temp_record RECORD;
temp_out_value VARCHAR[];
--temp_member_struct MEMBER_STRUCT;
temp_iterator INTEGER := 0;

BEGIN

FOR temp_record IN EXECUTE '
SELECT DISTINCT ON
    (' || in_sort || ')
    u.user_uuid,
    u.firstname,
    u.preposition,
    u.lastname,
    array_to_string_ex(ARRAY(SELECT email FROM emails WHERE user_uuid = u.user_uuid)) as emails,
    array_to_string_ex(ARRAY(SELECT mobilenumber FROM mobilenumbers WHERE user_uuid = u.user_uuid)) as mobilenumbers,
    array_to_string_ex(ARRAY(SELECT c.name FROM targetgroupusers AS tgu LEFT JOIN membercategories as mc ON mc.targetgroup_uuid = tgu.targetgroup_uuid LEFT JOIN categories AS c ON mc.category_uuid = c.category_uuid WHERE tgu.user_uuid = u.user_uuid)) as categories,
    array_to_string_ex(ARRAY(SELECT color FROM membercategories WHERE targetgroup_uuid IN(SELECT targetgroup_uuid FROM targetgroupusers WHERE user_uuid = u.user_uuid))) as colors
FROM
    membercategories AS mc
LEFT JOIN
    targetgroups AS tg
ON
    tg.targetgroup_uuid = mc.targetgroup_uuid
LEFT JOIN
    targetgroupusers AS tgu
ON
    tgu.targetgroup_uuid = tg.targetgroup_uuid
LEFT JOIN
    users AS u
ON
    u.user_uuid = tgu.user_uuid
WHERE
    mc.company_uuid = ''' || in_company_uuid || '''
    ' || in_querystring || '
    ' || in_filterstring || '
ORDER BY
   ' || in_sort || ' ' || in_order || '
OFFSET
    ' || in_start || '
LIMIT
    ' || in_limit

LOOP
 temp_out_value[temp_iterator] = ARRAY[temp_record.user_uuid::VARCHAR(36),
                                       temp_record.firstname,
                                       temp_record.preposition,
                                       temp_record.lastname,
                                       temp_record.emails,
                                       temp_record.mobilenumbers,
                                       temp_record.categories,
                                       temp_record.colors];
 temp_iterator = temp_iterator+1;
END LOOP;

out_status := 0;
out_status_description := 'Members retrieved';
out_value := temp_out_value;

RETURN;

END$$;

这是我调用函数的方式：

def get_members(companyuuid, start, limit, sort, order, querystring = None, filterstring = None):
    logRequest()
    def doWork(cursor):        
        if not companyuuid:
            raise Exception("companyuuid cannot be None!")   

        queryarray = [str(s) for s in querystring.split("|")]        
        queryfields = ['firstname', 'preposition', 'lastname', 'emails', 'mobilenumbers']

        temp_querystring = ""
        for j in xrange(len(queryfields)):
            for i in xrange(len(queryarray)):
                temp_querystring += "(u.%s LIKE ''%%%s%'') OR "%(queryfields[j], queryarray[i])

        temp_querystring = "AND %s"%temp_querystring.rstrip(" OR ")
        temp_filterstring = filterstring
        print "querystring: %s"%temp_querystring

        heizoodb.call(cursor=cursor,
                      scheme="public", 
                      function="get_members", 
                      functionArgs=(companyuuid, start, limit, sort, order, temp_querystring, temp_filterstring),
                      returnsValue=True)

我最近的错误 =D

com.gravityzoo.core.libs.sql.PostgreSQLDB.runSQLTransaction：格式字符串的参数不足，结果=[None]

SQLinjection 稍后添加 ;)

谢谢！

【问题讨论】：

不清楚你在做什么。请发布更完整的代码。你是如何将数据插入数据库的？
我的错！我编辑了主帖
out_string 应该是 IN OUT 吗？

标签： python quotes plpgsql

【解决方案1】：

我不太了解 Python，但它可能支持数据绑定，您首先准备一个语句（并且您不需要在问号周围加上引号）：

prepare("..... AND (u.firstname LIKE ?) OR (u.firstname LIKE ?)")

然后你调用 execute('koen', 'dirk') 或 Python 中调用的任何函数。

【讨论】：