From 35232b5c378f2186f77a98a2604f1fabb5a180ca Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Tue, 8 Sep 2026 21:16:34 -0700 Subject: [PATCH] Escape primary-key identifiers in row queries --- datasette/utils/__init__.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/datasette/utils/__init__.py b/datasette/utils/__init__.py index 14f40f7e..495060c1 100644 --- a/datasette/utils/__init__.py +++ b/datasette/utils/__init__.py @@ -1566,7 +1566,13 @@ async def row_sql_params_pks(db, table, pk_values): if use_rowid: select = "rowid, *" pks = ["rowid"] - wheres = [f'"{pk}"=:p{i}' for i, pk in enumerate(pks)] + wheres = [] + for i, pk in enumerate(pks): + escaped_pk = escape_sqlite(pk) + # Preserve the historic always-quoted SQL exposed by _extra=query + if escaped_pk == pk: + escaped_pk = f'"{pk}"' + wheres.append(f"{escaped_pk}=:p{i}") sql = f"select {select} from {escape_sqlite(table)} where {' AND '.join(wheres)}" params = {} for i, pk_value in enumerate(pk_values):