0

Can I have another function to return the last timestamp. I want to compare with this query to use the best query.

My query:

CREATE OR REPLACE FUNCTION f_last_update1(nomTable text , OUT updated timestamp)
  LANGUAGE plpgsql AS
$func$
BEGIN
   EXECUTE 'SELECT max(updated) FROM ' || nomTable
   INTO updated;   
END
$func$; 
Laurenz Albe
  • 61,070
  • 4
  • 55
  • 90

1 Answers1

0

Your function is insecure and vulnerable to SQL injection:

SELECT f_last_update1('sometable; DROP TABLE sometable; SELECT current_timestamp');

Use

CREATE OR REPLACE FUNCTION f_last_update1(
   IN  nomSchema text,
   IN  nomTable text,
   OUT updated timestamp)
  LANGUAGE plpgsql AS
$func$
BEGIN
   EXECUTE format(
              'SELECT max(updated) FROM %I.%I',
              nomSchema,
              nomTable
           )
      INTO updated;
END
$func$;
Laurenz Albe
  • 61,070
  • 4
  • 55
  • 90