PG_ESCAPE_STRING(n)

💅 PG_ESCAPE_STRING() 💅

okay bestie, welcome to the PostgreSQL Tcl Interface Documentation page for pg_escape_string — she's here to keep your SQL from going feral. 🦋

---

🌸 NAME 🌸

pg_escape_string — escapes a string for inclusion into SQL statements. It's literally the same as pg_quote; it was added for consistency. no cap ✨

✨ SYNOPSIS ✨

pg_escape_string string

🦋 DESCRIPTION 🦋

pg_escape_string quotes a string and escapes single quotes and backslashes within the string, making it safe for inclusion into SQL statements. it's giving "safety but make it cute" 💅

If you're doing something like:

pg_exec $conn "insert into foo values ('$name');"

and name contains text including an unescaped single quote — like Bob's House — then at best the insert will fail, and at worst your software will be exploited via an SQL injection attack. 😭 (not the vibe, bestie.)

Passing value strings through pg_escape_string will properly quote them for insertion into SQL commands. Like:

pg_exec $conn "insert into foo values ([pg_escape_string $name]);"

...will make sure that any special characters that occur in name, such as a single quote or a backslash, will be properly quoted. periodt. 🔥

⚠️ real talk: that SQL injection scenario is why escaping matters. escape your strings before they end up in the group chat. 💀

🍓 ARGUMENTS 🍓

• string — the string to be escaped, bestie. 🍓

🎀 RETURN VALUE 🎀

Returns the string, escaped for inclusion into SQL queries. Note that it also adds a set of single quotes around the outside of the string as well — so yes, she's doing the absolute most, and that's on purpose. 💖

🌈 SEE ALSO 🌈

In most cases, with recent versions of SQL, it is better to use the native parameter insertion capabilities of the SQL server and protocol. 🫶

If you are using a version of PostgreSQL more recent than 7.4, consider the optional parameter arguments to pg_exec and pg_sendquery, and the paramarray option to pg_exec, pg_sendquery, and pg_select. iykyk 🌟

---

xoxo bestie 💖 — source/version: PostgreSQL Tcl Interface Documentation, dated 17 September 2020. bye 🫶