Bruce Momjian <pgman@candle.pha.pa.us> writes:
> Jan, would you take a look at this? It is reproducable. I see the
> query sending "CREATE USER $1 ..." in the server logs.
Hardly requires much looking: utility statements don't take parameter
symbols, only literal constants. The only way to do this from plpgsql
at the moment is with EXECUTE.
regards, tom lane