1
- from datetime import date , datetime , timezone
1
+ from datetime import date , datetime , time , timezone
2
2
from enum import Enum
3
3
from ipaddress import IPv4Address , IPv6Address
4
4
from typing import Sequence , Dict , Union
@@ -37,7 +37,8 @@ def escape_binary(item: bytes, context):
37
37
return b2s [1 :]
38
38
39
39
40
- def escape_param (item , context ):
40
+ @escape .maybe_enquote_for_server
41
+ def escape_param (item , context , for_server = False ):
41
42
if item is None :
42
43
return 'NULL'
43
44
@@ -47,17 +48,23 @@ def escape_param(item, context):
47
48
elif isinstance (item , date ):
48
49
return "'%s'" % item .strftime ('%Y-%m-%d' )
49
50
51
+ elif isinstance (item , time ):
52
+ return "'%s'" % item .strftime ('%H:%M:%S' )
53
+
50
54
elif isinstance (item , str ):
55
+ # We need double escaping for server-side parameters.
56
+ if for_server :
57
+ item = '' .join (escape .escape_chars_map .get (c , c ) for c in item )
51
58
return "'%s'" % '' .join (escape .escape_chars_map .get (c , c ) for c in item )
52
59
53
60
elif isinstance (item , list ):
54
- return "[%s]" % ', ' .join (str (escape_param (x , context )) for x in item )
61
+ return "[%s]" % ', ' .join (str (escape_param (x , context , for_server = for_server )) for x in item )
55
62
56
63
elif isinstance (item , tuple ):
57
- return "(%s)" % ', ' .join (str (escape_param (x , context )) for x in item )
64
+ return "(%s)" % ', ' .join (str (escape_param (x , context , for_server = for_server )) for x in item )
58
65
59
66
elif isinstance (item , Enum ):
60
- return escape_param (item .value , context )
67
+ return escape_param (item .value , context , for_server = for_server )
61
68
62
69
elif isinstance (item , (UUID , IPv4Address , IPv6Address )):
63
70
return "'%s'" % str (item )
@@ -69,19 +76,19 @@ def escape_param(item, context):
69
76
return item
70
77
71
78
72
- def escape_params (params : Params , context : Dict ) -> Params :
79
+ def escape_params (params : Params , context : Dict , for_server = False ) -> Params :
73
80
"""Escape param to qualified string representation.
74
81
75
82
This function is not used in INSERT INTO queries.
76
83
"""
77
84
if isinstance (params , Dict ):
78
85
escaped = {
79
- key : escape_param (value , context )
86
+ key : escape_param (value , context , for_server = for_server )
80
87
for key , value in params .items ()
81
88
}
82
89
else :
83
90
escaped = tuple (
84
- escape_param (value , context )
91
+ escape_param (value , context , for_server = for_server )
85
92
for value in params
86
93
)
87
94
0 commit comments