From 83ca4c802f5d5102e73ff366e61514ded81dc7a1 Mon Sep 17 00:00:00 2001 From: Amjith Ramanujam Date: Sat, 31 Aug 2019 23:20:15 -0700 Subject: [PATCH] Escape the table name in populate_fts and search. --- sqlite_utils/db.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/sqlite_utils/db.py b/sqlite_utils/db.py index 6247428..ede477d 100644 --- a/sqlite_utils/db.py +++ b/sqlite_utils/db.py @@ -729,7 +729,7 @@ class Table(Queryable): def populate_fts(self, columns): sql = """ INSERT INTO "{table}_fts" (rowid, {columns}) - SELECT rowid, {columns} FROM {table}; + SELECT rowid, {columns} FROM "{table}"; """.format( table=self.name, columns=", ".join(columns) ) @@ -796,7 +796,7 @@ class Table(Queryable): def search(self, q): sql = """ - select * from {table} where rowid in ( + select * from "{table}" where rowid in ( select rowid from [{table}_fts] where [{table}_fts] match :search )