=?UTF-8?Q?Johannes_Gra=c3=abn?= <johannes@selfnet.de> writes:
> Before using format(), I tried just generating those strings by doubling
> any single quote or backslash and enclosing the whole string in single
> quotes, but that didn't seem a safe way, though it works in principle:
That's the documented requirement, so I don't see why it wouldn't be
safe.
regards, tom lane