Revision 2077
Added by Aaron Marcuse-Kubitza over 12 years ago
| lib/sql.py | ||
|---|---|---|
| 222 | 222 |
|
| 223 | 223 |
##### Input validation |
| 224 | 224 |
|
| 225 |
def clean_name(name): return re.sub(r'\W', r'', name) |
|
| 226 |
|
|
| 225 | 227 |
def check_name(name): |
| 226 | 228 |
if re.search(r'\W', name) != None: raise NameException('Name "'+name
|
| 227 | 229 |
+'" may contain only alphanumeric characters and _') |
| ... | ... | |
| 371 | 373 |
|
| 372 | 374 |
if embeddable: |
| 373 | 375 |
# Create function |
| 374 |
function = 'pg_temp.'+('_'.join(['insert_returning', table] + cols))
|
|
| 376 |
function = 'pg_temp.'+('_'.join(map(clean_name,
|
|
| 377 |
['insert_returning', table] + cols))) |
|
| 375 | 378 |
return_type = 'SETOF '+table+'.'+returning+'%TYPE' |
| 376 | 379 |
function_query = '''\ |
| 377 | 380 |
CREATE OR REPLACE FUNCTION '''+function+'''() RETURNS '''+return_type+''' |
| ... | ... | |
| 556 | 559 |
|
| 557 | 560 |
def put(db, table, row, pkey, row_ct_ref=None): |
| 558 | 561 |
'''Recovers from errors. |
| 559 |
Only works under PostgreSQL (uses `INSERT ... RETURNING`)''' |
|
| 562 |
Only works under PostgreSQL (uses INSERT RETURNING). |
|
| 563 |
''' |
|
| 560 | 564 |
try: |
| 561 | 565 |
cur = try_insert(db, table, row, pkey) |
| 562 | 566 |
if row_ct_ref != None and cur.rowcount >= 0: |
Also available in: Unified diff
sql.py: Added clean_name(). Use it where needed to make an escaped name appendable as a string.