Skip to content

DOC: Add docs for read_sql to avoid sql injection #56546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jan 17, 2024
Merged

DOC: Add docs for read_sql to avoid sql injection #56546

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
86b2ad9
add docs for read_sql to avoid sql injection
Dec 18, 2023
5909846
resolve formatting
Dec 18, 2023
206b52f
re-word the docs
erichxchen Dec 26, 2023
4ec7ff1
formatting
erichxchen Dec 26, 2023
1a639d4
refactor the example due to the length constraints
erichxchen Dec 26, 2023
7018cb1
remove reference directing users to use params
erichxchen Jan 2, 2024
8221d94
changed to the general warning
erichxchen Jan 14, 2024
a040f61
Merge branch 'main' into update-docs-for-read-sql
erichxchen Jan 16, 2024
ef5f9f0
add the example for using params
erichxchen Jan 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 17 additions & 1 deletion pandas/io/sql.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,6 +652,14 @@ def read_sql(
read_sql_table : Read SQL database table into a DataFrame.
read_sql_query : Read SQL query into a DataFrame.

Notes
-----
``pandas`` does not attempt to sanitize SQL statements;
instead it simply forwards the statement you are executing
to the underlying driver, which may or may not sanitize from there.
Please refer to the underlying driver documentation for any details.
Generally, be wary when accepting statements from arbitrary sources.

Examples
--------
Read data from SQL via either a SQL query or a SQL tablename.
Expand All @@ -672,6 +680,14 @@ def read_sql(

>>> pd.read_sql('test_data', 'postgres:///db_name') # doctest:+SKIP

For parameterized query, using ``params`` is recommended over string interpolation.

>>> from sqlalchemy import text
>>> sql = text('SELECT int_column, date_column FROM test_data WHERE int_column=:int_val')
>>> pd.read_sql(sql, conn, params={'int_val': 1}) # doctest:+SKIP
int_column date_column
0 1 12/11/10

Apply date parsing to columns through the ``parse_dates`` argument
The ``parse_dates`` argument calls ``pd.to_datetime`` on the provided columns.
Custom argument values for applying ``pd.to_datetime`` on a column are specified
Expand All @@ -694,7 +710,7 @@ def read_sql(
int_column
0 0
1 1
"""
""" # noqa: E501

check_dtype_backend(dtype_backend)
if dtype_backend is lib.no_default:
Expand Down