probcomp/bayeslite

query parameters for names, not just values

Open

#156 opened on Sep 16, 2015

View on GitHub
 (5 comments) (0 reactions) (0 assignees)Python (915 stars) (63 forks)batch import
help wantedk min/hr

Description

We have far too much

qcn = bql_quote_name(column_name)
cursor = bdb.execute('ESTIMATE ... %s ... FROM t' % (qcn,))

throughout the tree. We have a mechanism for query parameters to pass in values, but no mechanism for query parameters to specify the names of tables, columns, &c.

Contributor guide

Tech stack
pythonsqlite
Domain
backenddatabase
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
half day
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
PythonSQLBasic understanding of SQL injection and parameterization
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40
Research direction
Investigate the current implementation of query parameters in the codebase, particularly how values are parameterized. Look at the usage of bql quote name in the codebase to understand how table/column names are currently handled. Propose a design for a new parameter mechanism that allows specifying names (e.g., table names, column names) in queries, possibly using a similar syntax to value parameters but with a different delimiter. Evaluate potential SQL injection risks and ensure safe quoting. Check if there are any existing discussions in the comments (5 comments) that provide additional constraints or suggestions.