Re: Sanitize schema name - Mailing list psycopg

From Elliot S
Subject Re: Sanitize schema name
Date
Msg-id 55535C26.6020803@gmail.com
Whole thread Raw
In response to Re: Sanitize schema name  ("P. Christeas" <xrg@linux.gr>)
Responses Re: Sanitize schema name
List psycopg
I like this idea and drafted it up.

Looking for comments on this patch:

https://github.com/yieldsfalsehood/psycopg2/commit/f86f773de6ee99e2d7a2807136dcb458d97ba852

In short:
  1. identifier quoting may use PQescapeIdentifier if it's available, otherwise the pure-psyco escaping is done
  2. the %t format is now accepted, and its value must be either a string or bytes (no error handling is done yet if this isn't the case) - replacement for this calls out to the identifier quoting

On 05/10/2015 05:00 AM, P. Christeas wrote:
On Thursday 07 of May 2015, Daniele Varrazzo wrote:
Looks like there is more and more the need of exposing a function like
libpq's PQescapeIdentifier [1]. Too bad psycopg 2.6 has been released
so recently, I'm reluctant to add such a function to 2.6.1.

Maybe releasing a small Python module exposing just that function,
then add the functionality to psycopg 2.7?
I vote for a pre-release of 2.7, with this feature. Modifying the API, even if 
the new function wouldn't interfere with any existing ones, calls for a 
version bump.

Just another idea, would it make sense to abuse the semantics of string 
formatting[1] and introduce another type, say "%t" [2] for implicit identifier 
escaping?

This would make our queries look like:  cr.execute("SELECT id FROM %t WHERE name = %s", ('some.tbl', 'spam'))



[1] https://docs.python.org/2/library/stdtypes.html#string-formatting
[2] I notice that "t" isn't used for anything else, so far.




psycopg by date:

Previous
From: Ludovic Gasc
Date:
Subject: Re: Sanitize schema name
Next
From: Federico Di Gregorio
Date:
Subject: Re: Sanitize schema name