Libpq and PGconn struct

Hi guys

I am using libpq for connecting to PostgreSQL Database.

But I cant find the description of this PGconn struct anywhere. Also in Postgres's documentation, there is nothing said about it.

Best wishes

PGconn is defined by a typedef; search the header files for the
structure it's defined to be.

Here it is....
libpq-fe.h has typedefed pg_conn as PGConn



Check the below link for definition of struct pg_conn

http://doxygen.postgresql.org/libpq-int_8h-source.html

hi guys
What I am trying to do is to make some queries to postgresql database using libpq, PQexec funcion.

generally there is no problem if I am using standard SQL query.
char* query="INSERT INTO students(id,name, age) values(2,'Chris', 23)";
PQexec(query);

But I need to make some values in this query such as name and age to be variables. Program should ask about name and age first and then prepare a statement and send it.

Suppose if I write this:
char *query="INSERT INTO student(id,name,age) values(2,";
char *name="Chris";
char *end="')";

Is there any function which allows me to concatenate those two or more strings in one string and then make a query to database? Is there any function which converts integer to string?

Best wishes

Try this code



Character field should be within single quotes.

It is better to use snprintf() instead of sprintf(). That way you can control how much is written to the string and also detect if it would have overflowed the string.

hi guys

That's working, but when I try to use scanf("%s",&name) it doesnt work.
char * query;
char * name;
scanf("%s",&name);
sprinf(query, "SELECT * FROM '%s'",name);

I've got a memory protect error.

Thanks in advance

czildren,

query and name variables are pointers and hence they need to allocated enough memory before using them.

I'm concerned here about one last part of this... while all of the examples you gave used constant strings, the question leads me to think that the actual name field would be from user input. Concatenating user data into a SQL query leaves you vulnerable to 'SQL injection', especially if you aren't vetting the data in some way first.

While SQL injection attacks are mostly associated with web-based queries, they can occur any time you paste data from input directly into a query. I recommend using PQexecParams() rather than PQexec(), as it ensures that data entered are passed to the DBMS in such a way that it cannot spoof the query. Better still would be to use PQprepare()

This is only a general outline; you'd have to work out how you would need to use it. If nothing else, you can avoid most of the business of string concatenation.