create table in postgresql function not work - postgresql

Question

I am a newbie to postgresql and now trying to create table in postgresql function. Though the function can be successfully created without raising any error, it always throw errors to say the table I created does not exist while the function trys to insert data into this table.
I am using pgadmin to create and test my function.
my code:
create or replace function f_produceMultiroleWorkload(sourceTable text, targetTable text) returns integer as $$
declare
mysql text;
record_cnt integer;
begin
record_cnt=0;
create temp table t_staff_job_division( staff_num varchar(30), cate_division varchar(30));
mysql:='insert into t_staff_job_division select staff_num, cate_division from (select staff_num, cate_division from bpc."' || $1 || '" group by 1,2) t1 where staff_num in (select distinct staff_num from bpc."' || $1 || '" where cate_division<>staff_division) and staff_num not in (select distinct staff_num from (select staff_num, count(distinct cate_division) as division_cnt from bpc."'|| $1 ||'" group by 1) t2 where division_cnt=1)' ;
execute mysql;
EXECUTE format(
'
CREATE TABLE IF NOT EXISTS %I.%I (
staff_num varchar(30) PRIMARY KEY,
cate_division varchar(30),
score numeric(18,7)
);
',
'bpc', $2
);
mysql:='insert into bpc.' || $2 ||' select t1.staff_num, t1.cate_division, sum(normalized_individual_gross_score) from bpc."' || $1 || '" t1 inner join t_staff_job_division t2 on t1.staff_num=t2.staff_num and t1.cate_division=t2.cate_division group by 1,2';
execute mysql;
if exists(select count(*) from bpc."' || $2 || '") then
mysql:='select count(*) from bpc."' || $2 || '"';
execute mysql into record_cnt;
else
record_cnt=0;
end if;
return record_cnt;
end;
$$ language plpgsql;
The error throws when function execute
mysql:='insert into bpc.' || $2 ||' select t1.staff_num, t1.cate_division, sum(normalized_individual_gross_score) from bpc."' || $1 || '" t1 inner join t_staff_job_division t2 on t1.staff_num=t2.staff_num and t1.cate_division=t2.cate_division group by 1,2';
Sine the prompt is in Chinese, it is no sense to publish it here. But generally speaking, it says the table named by bpc.$2 does not exist.
I will appreciate any help to assist me to solve this problem.
thanks in advance.

Answer 1

You are a victim of (accidental) SQL injection.
The second function argument (targettable) probably looks like this: CamelCase.
Now the CREATE TABLE statement, which is correctly constructed using format, looks like this:
CREATE TABLE bpc."CamelCase" ...
while the incorrectly constructed INSERT statement looks like
INSERT INTO bpc.CamelCase ...
Now SQL identifiers are folded to lower case in PostgreSQL unless they are (double) quoted, so the second statement will try to insert into bpc.camelcase. But table names are case sensitive, so that fails.
Recommendations:
Always use format to avoid SQL injection.
Avoid using anything but lower case ASCII letters, digits and _ in identifiers.
Unrelated, but the IF EXISTS in your function will also fail. You need dynamic SQL there too.

Answer 2

It seems that you need to make sure that your uppercase/lowercase naming is consistent. Here, you potentially run into a problem with uppercase/lowercase because $2 is inconsistently wrapped in double-quotes (").
Notice:
EXECUTE format(
'
CREATE TABLE IF NOT EXISTS %I.%I (
staff_num varchar(30) PRIMARY KEY,
cate_division varchar(30),
score numeric(18,7)
);
',
'bpc', $2
);
If $2 is "myTable", then the table will be created as bpc.mytable because when table/column names are not wrapped in double-quotes, PostgreSQL will automatically convert to lowercase. However, for this:
mysql:='select count(*) from bpc."' || $2 || '"';
The table name will get interpreted as bpc."myTable" and because it is in double-quotes, the uppercase T will be preserved. In Postgres mytable != "myTable", so you will get an error saying that bpc."myTable" does not exist.
Please consider using this format (notice double quotes):
EXECUTE format(
'
CREATE TABLE IF NOT EXISTS %I."%I" (
staff_num varchar(30) PRIMARY KEY,
cate_division varchar(30),
score numeric(18,7)
);
',
'bpc', $2
);