aws / aws/amazon-redshift-python-driver

[Feature] Support SQL string composition

Open
#168 1 comment 5 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
220
Forks
86
PR merge metrics
No merged PRs in 30d

Description

The redshift connector currently supports parameterised queries (aka bind variables) which is great.

However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```

Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.

Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the connector's existing parameterised-query support, then compare the identifier-composition approaches documented by pg8000 and psycopg. Done means users can safely compose dynamic Redshift identifiers such as schemas and table names, with protection against SQL injection.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, sql
Domain
databases, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.