Home Explore Blog CI



postgresql

9th chunk of `doc/src/sgml/spi.sgml`
a57f1b5917cec2155a5b168f2479cf7fb3a3df68ee60d4200000000100000fb6
 structure, as
      in <function>SPI_execute</function>
     </para>
    </listitem>
   </varlistentry>

   <varlistentry>
    <term><literal>ResourceOwner <parameter>owner</parameter></literal></term>
    <listitem>
     <para>
      This field is present for consistency
      with <function>SPI_execute_plan_extended</function>, but it is
      ignored, since the plan used
      by <function>SPI_execute_extended</function> is never saved.
     </para>
    </listitem>
   </varlistentry>
  </variablelist>
 </refsect1>

 <refsect1>
  <title>Return Value</title>

  <para>
   The return value is the same as for <function>SPI_execute</function>.
  </para>

  <para>
   When <parameter>options-&gt;dest</parameter> is NULL,
   <varname>SPI_processed</varname> and
   <varname>SPI_tuptable</varname> are set as in
   <function>SPI_execute</function>.
   When <parameter>options-&gt;dest</parameter> is not NULL,
   <varname>SPI_processed</varname> is set to zero and
   <varname>SPI_tuptable</varname> is set to NULL.  If a tuple count
   is required, the caller's <literal>DestReceiver</literal> object must
   calculate it.
  </para>
 </refsect1>
</refentry>

<!-- *********************************************** -->

<refentry id="spi-spi-execute-with-args">
 <indexterm><primary>SPI_execute_with_args</primary></indexterm>

 <refmeta>
  <refentrytitle>SPI_execute_with_args</refentrytitle>
  <manvolnum>3</manvolnum>
 </refmeta>

 <refnamediv>
  <refname>SPI_execute_with_args</refname>
  <refpurpose>execute a command with out-of-line parameters</refpurpose>
 </refnamediv>

 <refsynopsisdiv>
<synopsis>
int SPI_execute_with_args(const char *<parameter>command</parameter>,
                          int <parameter>nargs</parameter>, Oid *<parameter>argtypes</parameter>,
                          Datum *<parameter>values</parameter>, const char *<parameter>nulls</parameter>,
                          bool <parameter>read_only</parameter>, long <parameter>count</parameter>)
</synopsis>
 </refsynopsisdiv>

 <refsect1>
  <title>Description</title>

  <para>
   <function>SPI_execute_with_args</function> executes a command that might
   include references to externally supplied parameters.  The command text
   refers to a parameter as <literal>$<replaceable>n</replaceable></literal>, and
   the call specifies data types and values for each such symbol.
   <parameter>read_only</parameter> and <parameter>count</parameter> have
   the same interpretation as in <function>SPI_execute</function>.
  </para>

  <para>
   The main advantage of this routine compared to
   <function>SPI_execute</function> is that data values can be inserted
   into the command without tedious quoting/escaping, and thus with much
   less risk of SQL-injection attacks.
  </para>

  <para>
   Similar results can be achieved with <function>SPI_prepare</function> followed by
   <function>SPI_execute_plan</function>; however, when using this function
   the query plan is always customized to the specific parameter values
   provided.
   For one-time query execution, this function should be preferred.
   If the same command is to be executed with many different parameters,
   either method might be faster, depending on the cost of re-planning
   versus the benefit of custom plans.
  </para>
 </refsect1>

 <refsect1>
  <title>Arguments</title>

  <variablelist>
   <varlistentry>
    <term><literal>const char * <parameter>command</parameter></literal></term>
    <listitem>
     <para>
      command string
     </para>
    </listitem>
   </varlistentry>

   <varlistentry>
    <term><literal>int <parameter>nargs</parameter></literal></term>
    <listitem>
     <para>
      number of input parameters (<literal>$1</literal>, <literal>$2</literal>, etc.)
     </para>
    </listitem>
   </varlistentry>

   <varlistentry>
    <term><literal>Oid * <parameter>argtypes</parameter></literal></term>
    <listitem>
     <para>
      an array of length <parameter>nargs</parameter>, containing the
      <acronym>OID</acronym>s

Title: SPI_execute_extended Return Value and SPI_execute_with_args Function
Summary
This section finishes describing the return values of the `SPI_execute_extended` function, specifically addressing the scenarios when `options->dest` is NULL or not NULL and how `SPI_processed` and `SPI_tuptable` are affected. It then transitions to introducing the `SPI_execute_with_args` function, which executes a command with out-of-line parameters, mitigating SQL-injection risks. It details the function's purpose, advantages over `SPI_execute`, and considerations for using it versus `SPI_prepare` and `SPI_execute_plan` based on the frequency of command execution with different parameters.