Update using stored procedure in postgres?

Question

I want my stored procedure to allow user to update the data.

Here's the procedure :

CREATE OR REPLACE FUNCTION update_table (
   IN _table      character varying,
   IN _col_mod    character varying,
   IN _val_mod    character varying,
   IN _col_filter character varying,
   IN _val_filter character varying
)
RETURNS void
AS
$$
BEGIN
    RAISE NOTICE 'Update table %', _table;
    EXECUTE ' UPDATE ' || quote_ident(_table) || ' SET ' || quote_ident(_col_mod) || ' = $1 WHERE ' || quote_ident(_col_filter) || ' = $2'
    USING _val_mod, _val_filter;
END;
$$
LANGUAGE 'plpgsql' VOLATILE SECURITY DEFINER; 

I wanna ask, is this procedure is efficient? because it looks like I just recreate the query.

And the reason why I create a procedure like this is in my office I had new policy that DBA not allowed to perform query directly into database. We must use stored procedure to do the DML also data retrieval query.

Thanks in advance .. :D

Answer 1

If it is 9.1 you can use format() to make it more legible:

EXECUTE format(
    'UPDATE %I SET %I = $1 WHERE %I = $2', _table, _col_mod, _col_filter
    )
USING _val_mod, _val_filter;