PostgreSQL : Prevent SQL Injection in pl/pgsql function
Use parameter placeholders instead of concatenating the input into the SQL string.

create function A(in startdate varchar(10), in enddate varchar(10))
  RETURNS setof AB AS $$
declare
  l_startdate date;
  l_enddate date;
BEGIN
 l_startdate := to_date(startdate,'YYYY-MM-DD');
 l_enddate := to_date(enddate,'YYYY-MM-DD'); 

 return query execute
 'select rid,dcid,
        sum(case when id between 10 and 19 or id between 21 and 26 then noOfcaptured else 0 end) total_tilldate,
        sum(case when dateofevent &gt;= $1 and (id between 10 and 19 or id between 21 and 26) then noofcaptured else 0 end) total_range,
        sum(case when id not between 51 and 59 then cast(sizecaptured as double precision)/1048576 else 0 end) totalsize_tilldate,
        sum(case when dateofevent &gt;= $2 and id not between 51 and 59 then cast(sizecaptured as double precision)/1048576 else 0 end) totalsize_range
   from repostats
  where dateofevent&lt;= $3
  group by rid, dcid'
    using l_startdate, l_startdate, l_enddate;
END;
$$ LANGUAGE plpgsql;