aws / aws/amazon-redshift-python-driver
[Feature] Support SQL string composition
- 主要言語
- Python
- スター
- 220
- フォーク
- 86
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
The redshift connector currently supports parameterised queries (aka bind variables) which is great.
However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```
Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.
Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.
コントリビューションガイド
調査の方向性
Start by reviewing the connector's existing parameterised-query support, then compare the identifier-composition approaches documented by pg8000 and psycopg. Done means users can safely compose dynamic Redshift identifiers such as schemas and table names, with protection against SQL injection.
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- python, sql
- 領域
- databases, security
- issue の種類
- 機能追加
- 難易度
- 5/5
- 見積もり時間
- 1週間以上
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 35/100