Re: How to surround a selected value with double quotes?

Laurenz Albe <laurenz.albe@cybertec.at>

From: Laurenz Albe <laurenz.albe@cybertec.at>
To: "Subramanian,Ramachandran" <ramachandran.subramanian@alte-leipziger.de>, "pgsql-novice@lists.postgresql.org" <pgsql-novice@lists.postgresql.org>
Date: 2026-06-22T08:26:24Z
Lists: pgsql-novice
On Mon, 2026-06-22 at 07:46 +0000, Subramanian,Ramachandran wrote:
> I wrote a script to analyze and run vacuum on tables that need it.

I assume you are talking about a bash script.

> Sadly at the time I wrote the script, I never expected a schema name to be pure numbers. 
>  
> So my Script does not work now.
>  
> I want to add double quote marks to each schema name and table name select.
> I tried using the CONCAT function, but it does not work as I expected it to.
>  
> I would be grateful if someone can help me understand the mistake I am making with the CONCAT.

You are a victim of (self-inflicted) SQL injection.

Just surrounding the schema name with double quotes is not enough.
What if the schema name itself contains a double quote?

You should use PostgreSQL's functions to properly quote an identifier.
With a shell script, I think your only choice is to use SQL:

#!/bin/bash

schema='12345  43'
table='tab"567'

quoted_schema=$(psql -Atq -v var="$schema" <<EOF
SELECT quote_ident(:'var');
EOF
)

quoted_table=$(psql -Atq -v var="$table" <<EOF
SELECT quote_ident(:'var');
EOF
)

sql="SELECT col FROM $quoted_schema.$quoted_table"


Yours,
Laurenz Albe