PostgreSQL Tcl Interface Documentation | ||||
---|---|---|---|---|
Prev | Fast Backward | Fast Forward | Next |
pg_escape_string
quotes a string and escapes single
quotes and backslashes within the string, making it safe for inclusion
into SQL statements.
If you're doing something like
pg_exec $conn "insert into foo values ('$name');"
and name contains text includeing an unescaped single
quote, such as Bob's House, the insert will fail.
Passing value strings through pg_escape_string
make sure they can be used as values and stuff in PostgreSQL.
pg_exec $conn "insert into foo values ([pg_escape_string $name]);"
...will make sure that any special characters that occur in name, such as single quote or backslash, will be properly quoted.