postgresql Postgres触发器函数-动态表名和审计附加数据插入

raogr8fs  于 2023-01-25  发布在  PostgreSQL
关注(0)|答案(1)|浏览(189)

新的Postgres用户,探索触发器函数与Oracle比较。尝试编写一个通用触发器,将表名(和模式名,如果可能)作为输入,并将审计数据插入到相应的审计表中。但是遇到错误。下面是我尝试的示例代码之一...尝试格式,以及,但仍然得到错误时,尝试在审计表中传递额外的参数任何帮助/输入感谢。

CREATE OR REPLACE FUNCTION audit_function_tr()
RETURNS trigger
LANGUAGE plpgsql
AS $function$
declare
    input_table_name text;
    my_action  char(1);
begin
   input_table_name := 'employee.'||TG_ARGV\[0\];  -- audit table in different schema
   IF TG_OP = 'INSERT' THEN
      my_action  := 'I';
   elseif TG_OP = 'DELETE' THEN
      my_action := 'D';
   else
      my_action := 'U';
   END IF;
   end if;  
   EXECUTE 'INSERT INTO '|| input_table_name ||
'VALUES ' || (my_action,current_user, now(), row_to_json(old));
   IF TG_OP = 'DELETE' then
      RETURN OLD;
   ELSE
      RETURN NEW;
   end if;
END;
$function$
;

调用触发器时出现以下错误:

SQL Error \[42601\]: ERROR: syntax error at end of input
Where: PL/pgSQL function audit_function_tr() line 16 at EXECUTE
ERROR: syntax error at end of input
Where: PL/pgSQL function audit_function_tr() line 16 at EXECUTE
ERROR: syntax error at end of input
Where: PL/pgSQL function audit_function_tr() line 16 at EXECUTE
8i9zcol2

8i9zcol21#

您正在成为普通SQL注入的牺牲品。您必须正确地转义JSON值:

EXECUTE format(
           'INSERT INTO employee.%I VALUES (%L, %L, %L, %L)',
           TG_ARGV[0],
           my_action,
           current_user,
           now(),
           row_to_json(old)
        );

相关问题