From 0c866fd1946c73dead39ed6ea19a20b9b78af6a4 Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Thu, 10 Sep 2026 16:01:05 -0700 Subject: [PATCH] Escape primary-key identifiers in row queries --- datasette/views/table.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/datasette/views/table.py b/datasette/views/table.py index eeba67e9..36b2fcb9 100644 --- a/datasette/views/table.py +++ b/datasette/views/table.py @@ -823,7 +823,13 @@ async def _sql_params_pks(db, table, pk_values): if use_rowid: select = "rowid, *" pks = ["rowid"] - wheres = [f'"{pk}"=:p{i}' for i, pk in enumerate(pks)] + wheres = [] + for i, pk in enumerate(pks): + escaped_pk = escape_sqlite(pk) + # Preserve the historic always-quoted SQL exposed in row queries. + if escaped_pk == pk: + escaped_pk = f'"{pk}"' + wheres.append(f"{escaped_pk}=:p{i}") sql = f"select {select} from {escape_sqlite(table)} where {' AND '.join(wheres)}" params = {} for i, pk_value in enumerate(pk_values):