aws / aws/amazon-redshift-python-driver
[Feature] Support SQL string composition
- Langage dominant
- Python
- Étoiles
- 220
- Forks
- 86
- Métriques de merge des PR
- Aucune PR mergée en 30 j
Description
The redshift connector currently supports parameterised queries (aka bind variables) which is great.
However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```
Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.
Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start by reviewing the connector's existing parameterised-query support, then compare the identifier-composition approaches documented by pg8000 and psycopg. Done means users can safely compose dynamic Redshift identifiers such as schemas and table names, with protection against SQL injection.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- python, sql
- Domaine
- databases, security
- Type d'issue
- Fonctionnalité
- Difficulté
- 5/5
- Temps estimé
- Plus d'une semaine
- Activité
- À l'abandon
- Clarté
- Plutôt claire
- Accessibilité débutants
- 35/100