title: Am I safe against SQL injection
body: <p>I would like to know if I'm safe against SQL injection when I use something like that with PostgresSQL:</p>
  
  <pre><code>CREATE or REPLACE FUNCTION sp_list_name( VARCHAR )
  RETURNS SETOF v_player AS '
     DECLARE
        v_start_name ALIAS FOR $1;
        r_player  v_player%ROWTYPE;
        v_temp VARCHAR;
     BEGIN
        v_temp := v_start_name || ''%'';
        FOR r_player IN
           SELECT first_name, last_name FROM v_player WHERE last_name like v_temp
        LOOP
           RETURN NEXT r_player;
        END LOOP;
        RETURN;
     END;
  ' LANGUAGE 'plpgsql' VOLATILE;
  </code></pre>
  
  <p>I want to use this function to list player's name beginning with a letter.</p>
  
  <pre><code>select * from sp_list_name( 'A' );
  </code></pre>
  
  <p>gives me players with last name beginning with A.</p>
  
  <p>I tried to inject sql with</p>
  
  <pre><code>select * from sp_list_name( 'A; delete from t_player;--' );
  select * from sp_list_name( '''; delete from t_player;--' );
  </code></pre>
  
  <p>Am I safe ?</p>
  
  <p>Which case I could be injected ?</p>
  
  <p>Regards</p>