How to cast column name to prevent SQL injection?

Question

When defining EXECUTE in a PostgreSQL function, I can cast tables names to ::regclass to make sure they are valid relation names. Now, I want to extend that to column names, but I cannot find the right type for that.

My code:

...
BEGIN
    EXECUTE '
    UPDATE ' || tbl::regclass || ' SET ' || col || '=someVal WHERE idcol=id
    ';
END;
...

What to put after col to cast it to a column name?

Answer 1

quote_ident(col)

String functions