ddsql 0.0.2__tar.gz → 0.0.3__tar.gz

{ddsql-0.0.2 → ddsql-0.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ddsql
-Version: 0.0.2
+Version: 0.0.3
 Summary: SQL Query Library
 License: MIT
 License-File: LICENSE
@@ -58,6 +58,20 @@ or create your own by inheriting from `BaseSerializer`.
 | `date`               | `'2025-01-01'`           | `'2025-01-01'::date`                | `toDate('2025-01-01')`                            |
 | `list`/`tuple`/`set` | `(item1, item2, ...)`    | `(item1, item2, ...)`               | `(item1, item2, ...)`                             |
 
+String values are escaped according to the dialect rules, so quotes, backslashes 
+and control characters cannot break the query:
+
+- `BaseSerializer` doubles single quotes (`O'Brien` → `'O''Brien'`), as defined by the SQL standard.
+- `ClickhouseSerializer` escapes backslashes, single quotes and all control characters 
+  with backslash sequences (`O'Brien` → `'O\'Brien'`, newline → `\n`, other control characters → `\xHH`).
+- `PostgresSerializer` doubles single quotes; strings containing backslashes or control 
+  characters are emitted using the escape string syntax (`C:\dir` → `E'C:\\dir'`), which is 
+  interpreted the same way regardless of the `standard_conforming_strings` server setting. 
+  A NUL (`0x00`) character raises `ValueError`, since PostgreSQL cannot store it in text values.
+
+The serialized literal is always a single printable line. 
+To customize escaping in your own serializer, override the `escape_string` method.
+
 If you need to serialize a type not listed in the table, override the `serialize_other_object` method in your serializer:
 
 ```python

{ddsql-0.0.2 → ddsql-0.0.3}/README.md

@@ -36,6 +36,20 @@ or create your own by inheriting from `BaseSerializer`.
 | `date`               | `'2025-01-01'`           | `'2025-01-01'::date`                | `toDate('2025-01-01')`                            |
 | `list`/`tuple`/`set` | `(item1, item2, ...)`    | `(item1, item2, ...)`               | `(item1, item2, ...)`                             |
 
+String values are escaped according to the dialect rules, so quotes, backslashes 
+and control characters cannot break the query:
+
+- `BaseSerializer` doubles single quotes (`O'Brien` → `'O''Brien'`), as defined by the SQL standard.
+- `ClickhouseSerializer` escapes backslashes, single quotes and all control characters 
+  with backslash sequences (`O'Brien` → `'O\'Brien'`, newline → `\n`, other control characters → `\xHH`).
+- `PostgresSerializer` doubles single quotes; strings containing backslashes or control 
+  characters are emitted using the escape string syntax (`C:\dir` → `E'C:\\dir'`), which is 
+  interpreted the same way regardless of the `standard_conforming_strings` server setting. 
+  A NUL (`0x00`) character raises `ValueError`, since PostgreSQL cannot store it in text values.
+
+The serialized literal is always a single printable line. 
+To customize escaping in your own serializer, override the `escape_string` method.
+
 If you need to serialize a type not listed in the table, override the `serialize_other_object` method in your serializer:
 
 ```python

{ddsql-0.0.2 → ddsql-0.0.3}/ddsql/serializers/base.py

@@ -45,20 +45,25 @@ class BaseSerializer:
         return f'{value}'
 
     @staticmethod
-    def serialize_string(value: str) -> str:
-        return f"'{value}'"
+    def escape_string(value: str) -> str:
+        # SQL standard escaping: a single quote is escaped by doubling it
+        return value.replace("'", "''")
 
-    @staticmethod
-    def serialize_uuid(value: UUID) -> str:
-        return f"'{value}'"
+    @classmethod
+    def serialize_string(cls, value: str) -> str:
+        return f"'{cls.escape_string(value)}'"
 
-    @staticmethod
-    def serialize_datetime(value: datetime) -> str:
-        return f"'{value.isoformat()}'"
+    @classmethod
+    def serialize_uuid(cls, value: UUID) -> str:
+        return f"'{cls.escape_string(str(value))}'"
 
-    @staticmethod
-    def serialize_date(value: date) -> str:
-        return f"'{value.isoformat()}'"
+    @classmethod
+    def serialize_datetime(cls, value: datetime) -> str:
+        return f"'{cls.escape_string(value.isoformat())}'"
+
+    @classmethod
+    def serialize_date(cls, value: date) -> str:
+        return f"'{cls.escape_string(value.isoformat())}'"
 
     def serialize_collection(self, value: Collection) -> str:
         items = ', '.join(self.serialize_value(item) for item in value)

ddsql-0.0.3/ddsql/serializers/clickhouse.py

@@ -0,0 +1,50 @@
+from datetime import date, datetime
+from typing import Dict
+from uuid import UUID
+
+from ddsql.serializers import BaseSerializer
+
+
+def _build_escape_translation() -> Dict[int, str]:
+    # https://clickhouse.com/docs/en/sql-reference/syntax#string
+    translation = {
+        ord('\\'): '\\\\',
+        ord("'"): "\\'",
+        ord('\0'): '\\0',
+        ord('\a'): '\\a',
+        ord('\b'): '\\b',
+        ord('\t'): '\\t',
+        ord('\n'): '\\n',
+        ord('\v'): '\\v',
+        ord('\f'): '\\f',
+        ord('\r'): '\\r',
+    }
+    # control characters without a named escape sequence
+    for code in range(0x20):
+        translation.setdefault(code, f'\\x{code:02X}')
+    translation[0x7F] = '\\x7F'
+    return translation
+
+
+_ESCAPE_TRANSLATION = _build_escape_translation()
+
+
+class ClickhouseSerializer(BaseSerializer):
+    @staticmethod
+    def escape_string(value: str) -> str:
+        return value.translate(_ESCAPE_TRANSLATION)
+
+    @classmethod
+    def serialize_uuid(cls, value: UUID) -> str:
+        return f"toUUID('{cls.escape_string(str(value))}')"
+
+    @classmethod
+    def serialize_datetime(cls, value: datetime) -> str:
+        return f"parseDateTimeBestEffort('{cls.escape_string(value.isoformat())}')"
+
+    @classmethod
+    def serialize_date(cls, value: date) -> str:
+        return f"toDate('{cls.escape_string(value.isoformat())}')"
+
+
+__all__ = ('ClickhouseSerializer',)

ddsql-0.0.3/ddsql/serializers/postgres.py

@@ -0,0 +1,62 @@
+import re
+from datetime import date, datetime
+from typing import Dict
+from uuid import UUID
+
+from ddsql.serializers import BaseSerializer
+
+# Characters a regular literal cannot represent reliably: control characters have no escape
+# sequences there, and a backslash changes meaning when standard_conforming_strings is off.
+# Strings containing them are serialized with the escape string syntax (E'...') instead.
+_ESCAPE_SYNTAX_REQUIRED = re.compile(r'[\\\x00-\x1F\x7F]')
+
+
+def _build_escape_translation() -> Dict[int, str]:
+    # https://www.postgresql.org/docs/current/sql-syntax-lexical.html#SQL-SYNTAX-STRINGS-ESCAPE
+    translation = {
+        ord('\\'): '\\\\',
+        ord("'"): "''",
+        ord('\b'): '\\b',
+        ord('\t'): '\\t',
+        ord('\n'): '\\n',
+        ord('\f'): '\\f',
+        ord('\r'): '\\r',
+    }
+    # control characters without a named escape sequence
+    for code in range(0x20):
+        translation.setdefault(code, f'\\x{code:02X}')
+    translation[0x7F] = '\\x7F'
+    return translation
+
+
+_ESCAPE_TRANSLATION = _build_escape_translation()
+
+
+class PostgresSerializer(BaseSerializer):
+    @staticmethod
+    def escape_string(value: str) -> str:
+        # PostgreSQL follows the SQL standard: a single quote is escaped by doubling it
+        return value.replace("'", "''")
+
+    @classmethod
+    def serialize_string(cls, value: str) -> str:
+        if '\x00' in value:
+            raise ValueError('PostgreSQL does not support the NUL (0x00) character in string values')
+        if _ESCAPE_SYNTAX_REQUIRED.search(value):
+            return f"E'{value.translate(_ESCAPE_TRANSLATION)}'"
+        return f"'{cls.escape_string(value)}'"
+
+    @classmethod
+    def serialize_uuid(cls, value: UUID) -> str:
+        return f"'{cls.escape_string(str(value))}'::uuid"
+
+    @classmethod
+    def serialize_datetime(cls, value: datetime) -> str:
+        return f"'{cls.escape_string(value.isoformat())}'::timestamp"
+
+    @classmethod
+    def serialize_date(cls, value: date) -> str:
+        return f"'{cls.escape_string(value.isoformat())}'::date"
+
+
+__all__ = ('PostgresSerializer',)

{ddsql-0.0.2 → ddsql-0.0.3}/pyproject.toml

@@ -1,7 +1,7 @@
 [tool.poetry]
 name = "ddsql"
 description = "SQL Query Library"
-version = "0.0.2"
+version = "0.0.3"
 authors = ["davyddd"]
 license = "MIT"
 repository = "https://github.com/davyddd/ddsql"

ddsql-0.0.2/ddsql/serializers/clickhouse.py

@@ -1,21 +0,0 @@
-from datetime import date, datetime
-from uuid import UUID
-
-from ddsql.serializers import BaseSerializer
-
-
-class ClickhouseSerializer(BaseSerializer):
-    @staticmethod
-    def serialize_uuid(value: UUID) -> str:
-        return f"toUUID('{value}')"
-
-    @staticmethod
-    def serialize_datetime(value: datetime) -> str:
-        return f"parseDateTimeBestEffort('{value.isoformat()}')"
-
-    @staticmethod
-    def serialize_date(value: date) -> str:
-        return f"toDate('{value.isoformat()}')"
-
-
-__all__ = ('ClickhouseSerializer',)

ddsql-0.0.2/ddsql/serializers/postgres.py

@@ -1,21 +0,0 @@
-from datetime import date, datetime
-from uuid import UUID
-
-from ddsql.serializers import BaseSerializer
-
-
-class PostgresSerializer(BaseSerializer):
-    @staticmethod
-    def serialize_uuid(value: UUID) -> str:
-        return f"'{value}'::uuid"
-
-    @staticmethod
-    def serialize_datetime(value: datetime) -> str:
-        return f"'{value.isoformat()}'::timestamp"
-
-    @staticmethod
-    def serialize_date(value: date) -> str:
-        return f"'{value.isoformat()}'::date"
-
-
-__all__ = ('PostgresSerializer',)