aws / aws/amazon-redshift-python-driver
[Feature] Support SQL string composition
- Dominant language
- Python
- Stars
- 220
- Forks
- 86
- PR merge metrics
- No merged PRs in 30d
Description
The redshift connector currently supports parameterised queries (aka bind variables) which is great.
However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```
Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.
Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.
Contributor guide
Assessment
This issue has not been assessed yet.