title: plpgsql executing dynamic command why prefer identifier $1,$2 than raw string value
body: <blockquote>
  <p>The command string can use parameter values, which are referenced in
  the command as $1, $2, etc. These symbols refer to values supplied in
  the USING clause. This method is often preferable to inserting data
  values into the command string as text: <strong>it avoids run-time overhead of
  converting the values to text and back, and it is much less prone to
  SQL-injection attacks since there is no need for quoting or
  escaping.</strong> An example is:</p>
  </blockquote>
  <pre><code>EXECUTE 'SELECT count(*) FROM mytable WHERE inserted_by = $1 AND inserted &lt;= $2'
     INTO c
     USING checked_user, checked_date
  </code></pre>
  <p><a href="https://www.postgresql.org/docs/13/plpgsql-statements.html#PLPGSQL-STATEMENTS-EXECUTING-DYN" rel="nofollow noreferrer">https://www.postgresql.org/docs/13/plpgsql-statements.html#PLPGSQL-STATEMENTS-EXECUTING-DYN</a><br />
  <a href="https://github.com/postgres/postgres/tree/master/src/pl/plpgsql/src" rel="nofollow noreferrer">https://github.com/postgres/postgres/tree/master/src/pl/plpgsql/src</a></p>
  <p>using <code>$1</code>,<code>$2</code> the database know it refer to function parameter list identifier ordered from left to right.
  otherwise, the database need to <strong>the text</strong> compare with the function parameter list?
  Is possible to tell me which line of the source code is doing this execution.
  who it will prone SQL-injection, any simple example.</p>