Re: 'prepare' is not quite schema-safe

Vlad <marchenko@gmail.com> writes:
> SET search_path TO one;

> PREPARE st( VARCHAR(20) ) AS SELECT * FROM test WHERE item = $1;

> EXECUTE st( 'one' );

> SET search_path TO two;

> -- next statement fails because st selects from one.test, not from two.test
> EXECUTE st( 'two' );

That's what it is supposed to do.  It would hardly be possible to
"prepare" a query at all if we had to wait till EXECUTE to find out
which tables it was supposed to use.

            regards, tom lane