 <p>Because you are using strings rather than parameters, your example is vulnerable to SQL injection. It's best to avoid <code>pg_</code> functions. In your case there are two things you need to take into account:</p> <ul> <li>Learn the Drupal API (considering you are using Drupal this would be the best for code consistency</li> </ul> <p>or</p> <ul> <li>Use <a href="http://www.postgresql.org/docs/9.2/static/plpgsql.html">stored procedures</a></li> <li>Use a library like <a href="http://php.net/manual/en/ref.pdo-pgsql.php">PDO</a> or <a href="http://php.net/manual/en/function.pg-query-params.php">pg_query_params</a> which takes care of <a href="http://www.phpro.org/tutorials/Introduction-to-PHP-PDO.html#4.1">parameterized queries</a></li> </ul> <p>Normally you use stored procedures in addition to PDO, unfortunately sometimes this is not manageable because you have too much code. My advice is to use as much stored procedures as possible.</p>