PostgreSQL execute + date

Question

I am trying to create an SQL select statement in PL/pgSQL procedure. It was all fine until I had to add a date to the select. The problem is that to compare dates in select clause my date must be enclosed in single quotes '' (e.g. '01.01.2011'), but in my case it is already a text type and I can't add it there.

Below is a sample code that should have same problem:

CREATE OR REPLACE FUNCTION sample(i_date timestamp without time zone)
  RETURNS integer AS
$BODY$
DECLARE
  _count integer := 0;
  _sql text := '';
BEGIN

  IF i_date IS NOT NULL THEN
   _cond := _cond || ' AND t.created>' || i_date;
END IF;

_sql := 'SELECT count(*) FROM test t WHERE 1=1' || _cond;

EXECUTE _sql INTO _count;
RETURN _count;

END;
$BODY$
LANGUAGE plpgsql VOLATILE
COST 100;

Is there any other way to "escape" date? Or some other suggestions?

I'm a bit confused, do you mean that t.created in your example is varchar in the database? — Joachim Isaksson, Mar 19 '12 at 15:02
No, it is date. But if i_date does not have '' around it then it is doing arithmetical equation not comparing two dates. — srumjant, Mar 20 '12 at 07:49

score 2 · Accepted Answer · edited May 23 '17 at 12:00

To use insert values safely and efficiently into a dynamically build and executed SQL string, there are a number of possibilities. The best one is to use the USING clause like this:

CREATE OR REPLACE FUNCTION sample(_date timestamp without time zone)
RETURNS integer AS
$BODY$
BEGIN
    RETURN QUERY EXECUTE '
    SELECT count(*)::int
    FROM   test t
    WHERE  t.created > $1'
    USING  _date;
END;
$BODY$ LANGUAGE plpgsql VOLATILE;

This is actually a bad example, because it could be simplified to:

CREATE OR REPLACE FUNCTION sample(_date timestamp)
RETURNS integer AS
$BODY$
    SELECT count(*)::int
    FROM   test
    WHERE  created > $1;
$BODY$ LANGUAGE sql;

Another way would be to use quote_literal().
I wrote more about dynamic SQL in plpgsql here.

Thanks Erwin! quote_literal() is perfect for me. – srumjant Mar 20 '12 at 07:20 — srumjant, Mar 20 '12 at 07:20

PostgreSQL execute + date

1 Answers1