You are viewing a plain text version of this content. The canonical link for it is here.

Posted to user@arrow.apache.org by "michalc (via GitHub)" <gi...@apache.org> on 2025/05/24 15:25:55 UTC

[D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

GitHub user michalc created a discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

Is there a way to safely construct dynamic SQL for PostgreSQL in Python using ADBC?

I _think_ I’m essentially looking for the equivalent of [psycopg’s sql module](https://www.psycopg.org/psycopg3/docs/api/sql.html) for ADBC. Or maybe a way of using psycopg’s SQL module with ADBC?

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org

Re: [D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

Posted by "zeroshade (via GitHub)" <gi...@apache.org>.

GitHub user zeroshade added a comment to the discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

ADBC doesn't provide a module for dynamic SQL construction, but anything which can generate the query string could be used with ADBC (just as it could with standard DBAPI functions). In the case of the `psycopg` sql module you linked to, it appears to have an `as_string()` method that could generate the full query string which could then be passed to `cur.execute(...)` with ADBC.

The same would be true for things like sqlglot and so on which can generate the SQL query string for you.

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856#discussioncomment-13258987

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org

Re: [D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

Posted by "lidavidm (via GitHub)" <gi...@apache.org>.

GitHub user lidavidm added a comment to the discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

It's also possible to use ADBC with things like SQLAlchemy. If I can find the time I'd like to put together a PostgreSQL dialect for use with ADBC.

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856#discussioncomment-13260327

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org

Re: [D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

Posted by "michalc (via GitHub)" <gi...@apache.org>.

GitHub user michalc added a comment to the discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

> In the case of the psycopg sql module you linked to, it appears to have an as_string() method that could generate the full query string which could then be passed to cur.execute(...) with ADBC.

Ah! I was about to say "but as_string requires a very psycopg-y 'context' object" but I see it's now optional (and since it's a protocol could also construct something more adbc-y if needed...)

Thank you!

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856#discussioncomment-13261264

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org

Re: [D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

Posted by "michalc (via GitHub)" <gi...@apache.org>.

GitHub user michalc edited a discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

Is there a way to safely construct dynamic SQL for PostgreSQL in Python using ADBC?

I _think_ I’m essentially looking for the equivalent of [psycopg’s sql module](https://www.psycopg.org/psycopg3/docs/api/sql.html) for ADBC. Or maybe a way of using psycopg’s sql module with ADBC?

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org

Re: [D] Escaping identifiers for safe dynamic SQL in Python for PostgreSQL [arrow-adbc]

Posted by "lidavidm (via GitHub)" <gi...@apache.org>.

GitHub user lidavidm added a comment to the discussion: Escaping identifiers for safe dynamic SQL in Python for PostgreSQL

I also wouldn't necessarily be opposed to adding quoting utilities, but nothing as sophisticated as what psycopg has. https://github.com/apache/arrow-adbc/issues/1398

GitHub link: https://github.com/apache/arrow-adbc/discussions/2856#discussioncomment-13260329

----
This is an automatically sent email for user@arrow.apache.org.
To unsubscribe, please send an email to: user-unsubscribe@arrow.apache.org