sql-tstring 0.2.0

SQL-tString allows for f-string like construction of sql queries without allowing for SQL injection. The basic usage is as follows,

from sql_tstring import sql

a = 1

query, values = sql(
    """SELECT a, b, c
         FROM tbl
        WHERE a = {a}""",
    locals(),
)

The query is a str and values a list[Any], both are then typically passed to a DB connection. Note the parameters can only be identifiers that identify variables (in the above example in the locals()) e.g. {a - 1} is not valid.

SQL-tString will convert parameters to SQL placeholders where appropriate. In other locations SQL-tString will allow pre defined column or table names to be used,

from sql_tstring import sql, sql_context

col = "a"
table = "tbl"

with sql_context(columns={"a"}, tables={"tbl"}):
    query, values = sql(
        "SELECT {col} FROM {table}",
        locals(),
    )

If the value of col or table does not match the valid values given to the sql_context function an error will be raised.

from sql_tstring import Absent, sql

a = Absent
b = Absent

query, values = sql(
    """UPDATE tbl
          SET a = {a},
              b = 1
        WHERE b = {b}""",
    locals(),
)

from sql_tstring import sql

a = 1

query, values = sql(
    t"""SELECT a, b, c
          FROM tbl
         WHERE a = {a}""",
)