From e429bd2efa5c98454ab091fc9432c1b31612f4f7 Mon Sep 17 00:00:00 2001 From: Simon Willison Date: Wed, 9 Sep 2026 06:54:53 -0700 Subject: [PATCH] Reuse trusted magic parameter bindings for CSV exports --- datasette/views/database.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/datasette/views/database.py b/datasette/views/database.py index f54ffd38..2cb59dc0 100644 --- a/datasette/views/database.py +++ b/datasette/views/database.py @@ -857,7 +857,8 @@ class QueryView(View): raise DatasetteError("?sql= is required", status=400) async def fetch_data_for_csv(request, _next=None): - results = await db.execute(sql, params, truncate=True) + # Reuse the trusted magic parameter values prepared above. + results = await db.execute(sql, params_for_query, truncate=True) data = {"rows": results.rows, "columns": results.columns} return data, None, None