remote/datasette
1
0
Fork 0
mirror of https://github.com/simonw/datasette.git synced 2026-09-11 11:04:07 +02:00
Code Issues Projects Releases Packages Wiki Activity

Escape identifiers in upsert row readback

Browse source
This commit is contained in:
Simon Willison 2026-09-08 21:16:35 -07:00
commit 4c56ce2103
1 changed files with 9 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
datasette/views/table.py
View file

@ -1161,13 +1161,19 @@ class TableInsertView(BaseView):
if upsert:
# Fetch based on initial input IDs
where_clause = " OR ".join(
["({})".format(" AND ".join(f"{pk} = ?" for pk in pks))]
[
"({})".format(
" AND ".join(f"{escape_sqlite(pk)} = ?" for pk in pks)
)
]
* len(row_pk_values_for_later)
)
args = list(itertools.chain.from_iterable(row_pk_values_for_later))
fetched_rows = await db.execute(
"select {}* from [{}] where {}".format(
"rowid, " if pks == ["rowid"] else "", table_name, where_clause
"select {}* from {} where {}".format(
"rowid, " if pks == ["rowid"] else "",
escape_sqlite(table_name),
where_clause,
),
args,
)