Add PgConn.EscapeString

pgconn/pgconn.go

@@ -1193,3 +1193,20 @@ func (pgConn *PgConn) ExecBatch(ctx context.Context, batch *Batch) *MultiResultR
 
 	return multiResult
 }
+
+// EscapeString escapes a string such that it can safely be interpolated into a SQL command string. It does not include
+// the surrounding single quotes.
+//
+// The current implementation requires that standard_conforming_strings=on and client_encoding="UTF8". If these
+// conditions are not met an error will be returned. It is possible these restrictions will be lifted in the future.
+func (pgConn *PgConn) EscapeString(s string) (string, error) {
+	if pgConn.ParameterStatus("standard_conforming_strings") != "on" {
+		return "", errors.New("EscapeString must be run with standard_conforming_strings=on")
+	}
+
+	if pgConn.ParameterStatus("client_encoding") != "UTF8" {
+		return "", errors.New("EscapeString must be run with client_encoding=UTF8")
+	}
+
+	return strings.Replace(s, "'", "''", -1), nil
+}

pgconn/pgconn_test.go

@@ -791,6 +791,34 @@ func TestConnCopyToCanceled(t *testing.T) {
 	ensureConnValid(t, pgConn)
 }
 
+func TestConnEscapeString(t *testing.T) {
+	t.Parallel()
+
+	pgConn, err := pgconn.Connect(context.Background(), os.Getenv("PGX_TEST_DATABASE"))
+	require.NoError(t, err)
+	defer closeConn(t, pgConn)
+
+	tests := []struct {
+		in  string
+		out string
+	}{
+		{in: "", out: ""},
+		{in: "42", out: "42"},
+		{in: "'", out: "''"},
+		{in: "hi'there", out: "hi''there"},
+		{in: "'hi there'", out: "''hi there''"},
+	}
+
+	for i, tt := range tests {
+		value, err := pgConn.EscapeString(tt.in)
+		if assert.NoErrorf(t, err, "%d.", i) {
+			assert.Equalf(t, tt.out, value, "%d.", i)
+		}
+	}
+
+	ensureConnValid(t, pgConn)
+}
+
 func Example() {
 	pgConn, err := pgconn.Connect(context.Background(), os.Getenv("PGX_TEST_DATABASE"))
 	if err != nil {