aws / aws/amazon-redshift-python-driver
[Feature] Support SQL string composition
- 主要语言
- Python
- 星标
- 220
- 派生
- 86
- PR 合并指标
- 30 天内没有已合并 PR
描述
The redshift connector currently supports parameterised queries (aka bind variables) which is great.
However some of our use cases require other parts of a Redshift SQL query to be dynamically created. These include components such as the table name, the schema... and are commonly referred to as Identifiers. For example ``` f"SELECT * FROM {schema}.{table}"```
Other libraries such as [pg8000](https://github.com/tlocke/pg8000#many-sql-statements-can-t-be-parameterized) and [psycopg](https://www.psycopg.org/docs/sql.html) have developed modules to escape these variables via identifiers.
Beyond usability, the main advantage of this approach is that it helps with SQL injection attacks.
贡献指南
调研方向
首先检查 connector 现有的参数化查询支持,然后比较 pg8000 和 psycopg 文档中介绍的标识符组合方法。完成的标准是用户能够安全地组合动态 Redshift 标识符(例如 schema 和表名),并能防止 SQL injection。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python, sql
- 领域
- databases, security
- Issue 类型
- 功能
- 难度
- 5/5
- 预计耗时
- 一周以上
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 35/100