50 Functions and PL/pgSQL

PostgreSQL lets you define your own functions. The simplest are SQL functions — a function body that is one or more SQL statements; PostgreSQL can often inline them. The more powerful are PL/pgSQL functions — written in a procedural language built into the server, with variables, loops, conditions, and exceptions. PL/pgSQL is what you use for triggers, complex business logic, and one-off maintenance routines. There are also PL/Python, PL/Perl, and others, but PL/pgSQL is always available and is what you should learn first.

What you’ll learn

• The CREATE FUNCTION syntax
• The difference between LANGUAGE sql and LANGUAGE plpgsql
• Volatility categories: IMMUTABLE, STABLE, VOLATILE
• Variables, IF, LOOP, and RAISE NOTICE in PL/pgSQL
• SECURITY DEFINER and the search_path warning

Example

-- A simple SQL function
CREATE OR REPLACE FUNCTION square(x integer)
RETURNS integer
LANGUAGE sql
IMMUTABLE
AS $$
  SELECT x * x;
$$;

SELECT square(7) AS result;

-- A SQL function that returns a set (multiple rows)
CREATE OR REPLACE FUNCTION recent_orders(min_total numeric)
RETURNS TABLE (id integer, customer_id integer, total numeric)
LANGUAGE sql
STABLE
AS $$
  SELECT id, customer_id, total
  FROM orders_example
  WHERE total >= min_total
  ORDER BY id;
$$;

SELECT * FROM recent_orders(20);

-- A PL/pgSQL function with control flow
CREATE OR REPLACE FUNCTION classify_total(total numeric)
RETURNS text
LANGUAGE plpgsql
IMMUTABLE
AS $$
DECLARE
  result text;
BEGIN
  IF total IS NULL THEN
    result := 'unknown';
  ELSIF total < 20 THEN
    result := 'small';
  ELSIF total < 100 THEN
    result := 'medium';
  ELSE
    result := 'large';
  END IF;
  RETURN result;
END;
$$;

SELECT id, total, classify_total(total) AS bucket
FROM orders_example
ORDER BY id;

-- A function that loops and uses RAISE NOTICE (a print statement)
CREATE OR REPLACE FUNCTION ping(n integer)
RETURNS integer
LANGUAGE plpgsql
AS $$
DECLARE
  i integer;
BEGIN
  FOR i IN 1..n LOOP
    RAISE NOTICE 'ping %', i;
  END LOOP;
  RETURN n;
END;
$$;

SELECT ping(3);

-- Cleanup
DROP FUNCTION IF EXISTS square(integer);
DROP FUNCTION IF EXISTS recent_orders(numeric);
DROP FUNCTION IF EXISTS classify_total(numeric);
DROP FUNCTION IF EXISTS ping(integer);

A function declaration includes a name, argument list, return type, language, optional volatility, and body. The body is bracketed by dollar quotes ($$ ... $$) — these avoid the need to escape quotes inside the body. You can use $tag$ ... $tag$ if you ever need nested dollar quotes.

The volatility categories are critical for performance:

• IMMUTABLE: same inputs always produce the same output, no database state involved. The planner can constant-fold these into expressions and even pre-evaluate them at planning time. Use for math, string formatting, deterministic transforms.
• STABLE: same inputs produce the same output within a single statement, but may differ across statements (e.g. functions that read tables). This allows optimizations such as use in index scan conditions; it does not promise one evaluation per statement.
• VOLATILE (default): may return different results even within one statement (e.g. random(), clock_timestamp(), anything that modifies data); now() is STABLE. The planner re-evaluates every time.

Wrong volatility leads to wrong query plans — most beginners leave everything VOLATILE and pay the cost. Mark functions as IMMUTABLE / STABLE whenever true.

Run the example

To run:

$ psql -f source/functions-and-plpgsql.sql postgres
CREATE FUNCTION
 result
--------
     49
(1 row)
 ...
NOTICE:  ping 1
NOTICE:  ping 2
NOTICE:  ping 3
 ping
------
    3
(1 row)

Common pitfalls

• Defining a SECURITY DEFINER function (runs as the function owner) without setting search_path is a known privilege-escalation pattern. Use only trusted schemas, explicitly put pg_temp last, and qualify sensitive names; for example, SET search_path = pg_catalog, app, pg_temp if app is trusted.
• Marking a function IMMUTABLE when it actually reads tables — the planner caches a wrong value. Reserve IMMUTABLE for true math/string functions.
• Overloading by argument types is allowed but easy to abuse. recent_orders(numeric) and recent_orders(integer) are different functions; small calls may unexpectedly target the wrong one.
• PL/pgSQL uses semicolon-terminated statements. Keywords and unquoted identifiers are case-insensitive; quoted identifiers and string contents are case-sensitive. Be careful with reserved words inside the function body.

Downloads

SQL file: functions-and-plpgsql.sql · All lesson files · Setup guide