Re: a stored procedure ..with integer as the parameter

surabhi.ahuja wrote:
> what do u suggest i do then in that case?
> i mean how should i make a query - i mean how do i make a command? 

You should always provide well-defined escaping to all data coming from 
a non-trusted source (i.e. outside your application) and preferably to 
all data in any case.

If you are using "C" then libpq offers functions to escape strings. 
Almost all other languages offer something similar.

In general, I never use "raw" functions to build my queries, I have 
wrapper functions that ensure all queries are well-formed.

What language are you using, and what framework?

--
   Richard Huxton
   Archonet Ltd