How Can I Safely Pass a Table Name as a Parameter in psycopg2?

Use psycopg2 to safely pass table name parameters

In psycopg2, building queries with dynamic parameters can cause problems, as shown in the provided code. It is strongly recommended not to use string concatenation in the given code.

Using the psycopg2 SQL module

Psycopg2 provides a solution with its SQL module introduced in version 2.7. This module helps in dynamically generating queries including table name parameters. Its syntax is as follows:

<code>from psycopg2 import sql

# 示例：使用动态表名插入数据
cur.execute(
    sql.SQL("insert into {table} values (%s, %s)")
        .format(table=sql.Identifier('my_table')),
    [10, 20])</code>

Importance of correct parameterization

It is important to note that it is preferred to use psycopg2's SQL module rather than Python string manipulation or string parameter interpolation. The documentation explicitly warns against using these methods as they can introduce vulnerabilities and compromise database integrity.

For more information about the SQL module, please refer to the official documentation: https://www.php.cn/link/9a0f86604fa1dc1686a0cad86a808a5c:

• https://www.php.cn/link/9dd48d8df816e1b2b78a1573d0b6ce78
• https://www.php.cn/link/3d36c145f1f16c368173c437335b4acd

The above is the detailed content of How Can I Safely Pass a Table Name as a Parameter in psycopg2?. For more information, please follow other related articles on the PHP Chinese website!