How safe is helpers concat against SQL injections

[ilijaNL]

Hello,

I am currently using pgp.helpers.concat to batch up mutation queries (insert, update, delete) to reduce roundtrips, however since the string is concated into 1 single query without paramaters I wonder how safe it is against SQL injections?

[vitaly-t]

SQL injection is the issue with bad query-parameter escaping, when values are concatenated. This does not extend to queries as such, because you do not pass entire queries as URL parameters, but if you do - the flaw is then by design, no safety there.

Please use StackOverflow or Discussions ere for questions. This is for issues/bugs only.