Seems the old adage of "beware of blog posts bearing gifts" strikes again. For blog post masquerading as a how-to on securing Postgres, the fact the article on

Seems the old adage of "beware of blog posts bearing gifts" strikes again. For blog post masquerading as a how-to on securing Postgres, the fact the article only fleetingly mentions the word "function" once is not cool. One of the biggest things you can do for Postgres (or any database for that matter) is enforce the use of stored procedures ("functions" in PG-speak) rather than direct SQL queries. SQL Injection attacks are common as muck. Stored procedures are a quick and easy way to mitigate them. Stored procedures also have the added bonus of allowing the DBA to remain in control and ensure a higher quality of SQL query rather than upstream devs sending all manner of unoptimised SQL queries.