PostgreSQL Tcl Interface Documentation | ||||
---|---|---|---|---|
Prev | Fast Backward | Fast Forward | Next |
pg_escape_string
quotes a string and escapes single quotes and backslashes within the string, making it safe for inclusion into SQL statements.
If you're doing something like
pg_exec $conn "insert into foo values ('$name');"
and name
contains text includeing an unescaped single quote, such as Bob's House, the insert will fail. Passing value strings through pg_escape_string
make sure they can be used as values and stuff in PostgreSQL.
pg_exec $conn "insert into foo values ([pg_escape_string $name]);"
...will make sure that any special characters that occur in name, such as single quote or backslash, will be properly quoted.