surabhi.ahuja wrote:
> what do u suggest i do then in that case?
> i mean how should i make a query - i mean how do i make a command?
You should always provide well-defined escaping to all data coming from
a non-trusted source (i.e. outside your application) and preferably to
all data in any case.
If you are using "C" then libpq offers functions to escape strings.
Almost all other languages offer something similar.
In general, I never use "raw" functions to build my queries, I have
wrapper functions that ensure all queries are well-formed.
What language are you using, and what framework?
--
Richard Huxton
Archonet Ltd