imitatio creatio co we łbie piszczy

dynamic SQL parameters in PL/PgSQL functions

It pays to read documentation.

From PostgreSQL 8.3 to 8.4 there was one interesting addon for plpgsql: ability to pass parameter values directly into EXECUTE.

Of course depesz wrote about it. And I did read it; But still (by routine) I was using something like:

sql_query := 'SELECT foo FROM bar JOIN baz USING (barbaz) WHERE baz.id = ANY (__PARAM__::integer[])';
sql_query := replace(sql_query, '__PARAM__', quote_nullable(my_param);
EXECUTE sql_query INTO my_foos;

While it can be written in more elegant and error-prone way:

EXECUTE 'SELECT foo FROM bar JOIN baz USING (barbaz) WHERE baz.id = ANY ($1)'
INTO my_foos
USING my_param;