#23426: migrations.RunSQL's function signature implies it won't do any parameter
substitution
-------------------------------------+-------------------------------------
Reporter: ris | Owner: nobody
Type: Bug | Status: new
Component: Migrations | Version: 1.7
Severity: Normal | Resolution:
Keywords: migrations sql | Triage Stage:
runsql params escape | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Changes (by ris):
* needs_better_patch: => 0
* needs_tests: => 0
* needs_docs: => 0
Old description:
> Bit of an odd one here, and probably comes down to a matter of opinion.
>
> migrations.RunSQL not taking any params= argument seems to imply that it
> doesn't do any parameter substitution on the supplied SQL, which would
> mean that "%"s can be used freely in the SQL.
>
> This of course isn't the case and doing
>
> {{{
> migrations.RunSQL("UPDATE city_table SET description = 'silly' WHERE
> name ILIKE '%camelot%'")
> }}}
>
> will screw up because psycopg2 will be confused about the "%"s.
>
> Either RunSQL should accept params= and this should be documented or
> RunSQL should attempt to nullify this by doing something like .replace (
> "%" , "%%" ) to the SQL string.
New description:
Bit of an odd one here, and probably comes down to a matter of opinion.
migrations.RunSQL not taking any params= argument seems to imply that it
doesn't do any parameter substitution on the supplied SQL, which would
mean that "%"s can be used freely in the SQL.
This of course isn't the case and doing
{{{
migrations.RunSQL("UPDATE city_table SET description = 'silly' WHERE
name ILIKE '%camelot%'")
}}}
will screw up because psycopg2 will be confused about the "%"s.
Either RunSQL should accept params= and this should be documented or
RunSQL should attempt to nullify this by doing something like .replace (
"%" , "%%" ) to the SQL string to escape any.
--
Comment:
This bug seems awfully petty now that I've submitted it.
--
Ticket URL: <https://code.djangoproject.com/ticket/23426#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/061.c78a48ee8baf5dae499b35e662138d68%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
