On 29/06/12 17:10, Adrian Klaver wrote:
>>>
>>> Is there a possibility it could find its way into psycopg2 proper?
>>
>> Using str() is wrong: at least you should use adapt() and .getquoted()
>> to avoid SQL-injection attacks.
>
> The above was a quick and dirty hack. I am still working my way through
> the adaptation mechanism. In fact after I sent the previous, I had
> another thought:
>
> class HstoreAdapter(object):
> """Adapt a Python dict to the hstore syntax."""
> def __init__(self, wrapped, stringify=False):
> self.wrapped = wrapped
> if stringify:
> for k in self.wrapped:
> self.wrapped[k] = str(self.wrapped[k])
>
> This would preserve present behavior in the default case. I just am not
> sure how to pass the stringify flag down through the register_hstore()
> process.
Nah, adapter can't take extra arguments. Given that what you actually
*get* from the database are just strings I agree with you that
transforming everything to string on input too is good. We can raise an
exception unless all key/values are already strings but that will put
burden on the user for no good reason.
Unless Daniele has string objections to it or beats me to the
implementation (as always) I'll push something working this week end.
federico
--
Federico Di Gregorio federico.digregorio@dndg.it
Studio Associato Di Nunzio e Di Gregorio http://dndg.it
Il panda ha l'apparato digerente di un carnivoro (e.g., di un orso).
Il panda ha scelto di cibarsi esclusivamente di germogli di bambù.
Quindi, il panda è l'unico animale vegano del pianeta. Il panda
merita di estinguersi. -- Maria, Alice, Federico
