aws / aws/amazon-redshift-python-driver

[Feature] Support SQL string composition

Ouverte
#168 1 commentaire 5 réactions 0 personnes assignées Voir sur GitHub
enhancement
Langage dominant
Python
Étoiles
220
Forks
86
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

The redshift connector currently supports parameterised queries (aka bind variables) which is great.

However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```

Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.

Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start by reviewing the connector's existing parameterised-query support, then compare the identifier-composition approaches documented by pg8000 and psycopg. Done means users can safely compose dynamic Redshift identifiers such as schemas and table names, with protection against SQL injection.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
python, sql
Domaine
databases, security
Type d'issue
Fonctionnalité
Difficulté
5/5
Temps estimé
Plus d'une semaine
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.