如何在PostgreSQL中运行多个更新的语句

Question

我试图使用适当的参数运行此脚本，但它始终抛出语法错误。语法是否有问题。调用此函数的正确方法是什么。我需要一个输出来告诉我update语句已成功执行。 我尝试了“选择function_name（schema_name.TABLE_NAME）;”。让我补充一下，我是一个初学者，可以接受任何反馈。 如有必要，还将提供更多详细信息。

CREATE OR REPLACE FUNCTION function_name (TABLE_NAME IN character varying)
RETURNS text AS $SQLQuery$
DECLARE SQLQuery text;
BEGIN

SQLQuery = 
' UPDATE '|| TABLE_NAME || ' SET column1=''0''
WHERE column1 is null;' ||

' UPDATE '|| TABLE_NAME || ' SET column2='value'
WHERE column2=''different value'';' ||

--multiple update statements later

Execute  SQLQuery;
Return SQLQuery;

END;
$SQLQuery$
LANGUAGE plpgsql;

更新：这是我调用测试函数时遇到的错误

 ERROR: missing FROM-clause entry for table "schema_name" LINE 2: select test_function(schema_name.TABLE_NAME); ^ ********** Error ********** ERROR: missing FROM-clause entry for table "schema_name" SQL state: 42P01 

它是作为表读取函数吗？ 我还收到语法错误，说EXECUTE列不存在，或者即使我刚刚声明了该函数也不存在。

Answer 1

要在选址常量中使用单引号，必须通过将它们加倍来对其进行转义。

代替

' SET column1='0''

你必须写

' SET column1=''0'''

Answer 2

像：

CREATE OR REPLACE FUNCTION function_name (schema_name text,TABLE_NAME IN character varying)
RETURNS text AS $SQLQuery$
DECLARE 
  c int;
  rtn text :='';
BEGIN

execute format(' UPDATE %I.%I SET column1=''0'' WHERE column1 is null;',schema_name,TABLE_NAME);
get diagnostics c = row_count;
raise info '%', 'affected: '||c;
rtn = rtn + 'affected: '||c||chr(10);
--repeat above construct for multiple update statement
return rtn;
END;
$SQLQuery$
LANGUAGE plpgsql;

并提供建议。 我像您一样是新手，但是我学会了遵循一些规则，这些规则对我有帮助：

• 具有动态sql使用format以避免sql注入
• 不要过于复杂（例如，您要查找的功能已经在UPDATE语句中-检查输出。如​​果要检查结果行的使用，请使用UPDATE ... RETURNING *构造。
• 练习是好的，但阅读概念很宝贵。

在您的POST中select function_name(schema_name.TABLE_NAME); 将不起作用，因为您使用schema_name.TABLE_NAME不带引号，但是即使您加上引号，您的函数也很容易受到攻击-如果运行select function_name(';drop sometable;--');会发生什么情况select function_name(';drop sometable;--'); ？..

Answer 3

您正在尝试传递SQL标识符，但是您的函数改为使用字符串作为参数。 您应该将其更改为： select test_function('schema_name.TABLE_NAME');

您可以在下面尝试使用该功能作为您尝试做的事情的基础。

/* You need to split table and schema name
   or you might get errors when using names that aren't lower case.

   This: 'public.TEST1' would be translated to: "public.TEST1"
   that is different table from public.test1
*/
CREATE OR REPLACE FUNCTION multi_update_stuff(schema_name varchar, table_name varchar)
/* We will return set of multiple columns. One possible method is to return table.
   First column shows executed query, second if it returned no errors (true)
*/
RETURNS TABLE(SQLQuery text, result boolean)
AS $body$
DECLARE
  /* Declare arroy of queries that we will iterate and execute later.
     We use format() to build query from template and fill it with values.
     %1$I can be described as "put first value here and treat it as object identifier"
     %3$L can be described as "put third value here and treat it as SQL literal"
  */
  SQLQueries text[] := array[
    /* First query */
    format('UPDATE %1$I.%2$I SET column1 = %3$L WHERE column1 is null;',
           schema_name, table_name, '0'),
    /* Second query */
    format('UPDATE %1$I.%2$I SET column2 = %3$L WHERE column2 = %4$L;',
           schema_name, table_name, 'value', 'different value'),
    /* Third query, to see error free result */
    'SELECT 1'];
BEGIN
  /* Iterate our array */
  FOREACH SQLQuery IN ARRAY SQLQueries
  LOOP
    /* Start transaction block */
    BEGIN
      EXECUTE SQLQuery;
      result := true;
    /* Catch error if any */
    EXCEPTION
      WHEN others THEN
        result := false;
    END;
    /* Return row with whatever is assigned to variables listed in RETURNS.
       In this case SQLQuery was already assigned by FOREACH.
    */
    RETURN NEXT;
  END LOOP;
END;
$body$
LANGUAGE plpgsql;

SELECT * FROM multi_update_stuff('schema_name', 'TABLE_NAME')