Does stored procedure prevent SQL Injection in postgreSQL

In short - no, stored procedures does not prevent from SQL Injection. It depends on how you do handle dynamic SQL inside stored procedure.

For more complete answer, check what is posted here: http://stackoverflow.com/questions/627918/am-i-safe-against-sql-injection

Check these links and the picture will get clearer:

http://anubhavg.wordpress.com/2008/02/01/are-stored-procedures-safe-against-sql-injection/

http://www.sqlmag.com/article/sql-server/protecting-against-sql-injection.aspx

"...Measures to avoid SQL injection

1. Validate all input coming from the user on the server.
2. Avoid the use of dynamic SQL queries if there an alternate method is available.
3. Use parameterized stored procedure with embedded parameters.
4. Execute stored procedures using a safe interface such as Callable statements in JDBC or CommandObject in ADO.
5. Use a low privileged account to run the database.
6. Give proper roles and privileges to the stored procedure being used in the applications."

IF you use SP correctly, then you are pretty much safe from SQL Injection (assuming you still do proper input validation anyway, of course). IF.

Ah, but what does it mean, to use SP correctly?

Two of the most common mis-uses of SP that I see often, and can each lead to SQL Injection even with Stored Procedures, are:

• Dynamic SQL inside the SP.
• Calling the SP from code as you would execute a concatenated string. I.e. just sending to the database "exec spname (param1)", instead of using command/parameter objects (or parameterizing the query, depending on language). SQLi can still be injected into the SP call...

You need variable binding along with named parameters, regardless if the query is a stored procedure or not. Also need to worry about certain SQL statements like LIKE