diff options
| author | Mike Bayer <mike_mp@zzzcomputing.com> | 2020-07-13 10:49:57 -0400 |
|---|---|---|
| committer | Mike Bayer <mike_mp@zzzcomputing.com> | 2020-07-13 11:35:05 -0400 |
| commit | 9d0fb152069caa8de887aba28cef87f7acb32e37 (patch) | |
| tree | 10536df1713f937cf6c649beeda06f8c98049346 /lib/sqlalchemy/dialects/mssql | |
| parent | f9f9f0feb785ad08a3bbf8b24ce879c985d0975b (diff) | |
| download | sqlalchemy-9d0fb152069caa8de887aba28cef87f7acb32e37.tar.gz | |
test single and double quote inspection scenarios
Applied a sweep through all included dialects to ensure names that contain
single or double quotes are properly escaped when querying system tables,
for all :class:`.Inspector` methods that accept object names as an argument
(e.g. table names, view names, etc). SQLite and MSSQL contained two
quoting issues that were repaired.
Fixes: #5456
Change-Id: I3bc98806f5166f3d82275650079ff561446f2aef
Diffstat (limited to 'lib/sqlalchemy/dialects/mssql')
| -rw-r--r-- | lib/sqlalchemy/dialects/mssql/base.py | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/lib/sqlalchemy/dialects/mssql/base.py b/lib/sqlalchemy/dialects/mssql/base.py index 06ea80b9e..35e6799c5 100644 --- a/lib/sqlalchemy/dialects/mssql/base.py +++ b/lib/sqlalchemy/dialects/mssql/base.py @@ -2887,9 +2887,12 @@ class MSDialect(default.DefaultDialect): for col in cols: colmap[col["name"]] = col # We also run an sp_columns to check for identity columns: - cursor = connection.exec_driver_sql( - "sp_columns @table_name = '%s', " - "@table_owner = '%s'" % (tablename, owner) + cursor = connection.execute( + sql.text( + "sp_columns @table_name = :table_name, " + "@table_owner = :table_owner", + ), + {"table_name": tablename, "table_owner": owner}, ) ic = None while True: |