remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-12 03:24:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Escape primary-key identifiers in row queries

Browse source
This commit is contained in:
Simon Willison 2026-09-08 21:16:34 -07:00
commit 35232b5c37
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
datasette/utils/__init__.py
View file

@ -1566,7 +1566,13 @@ async def row_sql_params_pks(db, table, pk_values):
if use_rowid:
select = "rowid, *"
pks = ["rowid"]
wheres = [f'"{pk}"=:p{i}' for i, pk in enumerate(pks)]
wheres = []
for i, pk in enumerate(pks):
escaped_pk = escape_sqlite(pk)
# Preserve the historic always-quoted SQL exposed by _extra=query
if escaped_pk == pk:
escaped_pk = f'"{pk}"'
wheres.append(f"{escaped_pk}=:p{i}")
sql = f"select {select} from {escape_sqlite(table)} where {' AND '.join(wheres)}"
params = {}
for i, pk_value in enumerate(pk_values):