update postgresql with syntax errors

Question

I have one table called test, which has 4 columns:

id     INT
v_out  INT
v_in   INT
label  CHARACTER

I'm trying to update the table with the following query:

String sql = "
update
    test
set
    v_out = temp.outV
    , v_in = temp.inV
    , label = temp.label
from (
        values
            (1,234,235,'[abc]') // these value are read from other places
            ,(2,234,5585,'[def]') //[abc] = object.toString();
    ) as temp (e_id, outV, inV, label)
where
    id = temp.e_id;

When I execute it, I got the error: org.postgresql.util.PSQLException: ERROR: syntax error at or near "["

before get this error, i already update over 3000 rows.

so whats the reason caused this? is it because "[" this character? this is the original table:

create table edges(
 id serial not null primary key,
 vertex_out int, 
 vertex_in int, 
 label character varying(255),
 constraint fk_vertex_out foreign key (vertex_out) references vertices(id) on delete cascade,
 constraint fk_vertex_in foreign key (vertex_in) references vertices(id) on delete cascade
);

Answer 1

The most likely problem here is string interpolation in SQL query (it is a very bad practice).

Look at this example:

  values
      (1,234,235,'[abc]''),
      (2,234,5585,'[def]')

The ' symbol in the name of the first object breaches the string boundaries causing ERROR: syntax error at or near "[": on the second line.

You can search for SQL Injection in the internet to get details about this problem.