execsql2 2.22.9__py3-none-any.whl → 2.23.1__py3-none-any.whl

execsql/db/mysql.py

@@ -22,6 +22,7 @@ __all__ = ["MySQLDatabase"]
 _PYTHON_TO_MYSQL_CHARSET: dict[str, str] = {
     "utf-8": "utf8mb4",
     "utf8": "utf8mb4",
+    "utf8mb4": "utf8mb4",
     "latin-1": "latin1",
     "iso-8859-1": "latin1",
     "iso8859-1": "latin1",
@@ -31,9 +32,34 @@ _PYTHON_TO_MYSQL_CHARSET: dict[str, str] = {
 }
 
 
+def _crlf_terminated(filename: str) -> bool:
+    """True if the file's first line ends with CRLF.
+
+    Read as bytes so no decoding or newline translation can hide the answer.
+    """
+    try:
+        with open(filename, "rb") as f:
+            chunk = f.read(65536)
+    except OSError:
+        return False
+    i = chunk.find(b"\n")
+    return i > 0 and chunk[i - 1 : i] == b"\r"
+
+
 class MySQLDatabase(Database):
     """MySQL and MariaDB adapter using the pymysql package."""
 
+    #: Statements MySQL commits at once, together with everything before them
+    #: ("Statements That Cause an Implicit Commit" in the MySQL manual).
+    #: CREATE and DROP TEMPORARY TABLE are the exception.
+    implicit_commit_rx = re.compile(
+        r"(?:CREATE|ALTER|DROP)\s+(?!TEMPORARY\b)(?:OR\s+REPLACE\s+)?(?:UNIQUE\s+|FULLTEXT\s+|SPATIAL\s+)?\w+"
+        r"|RENAME\s+\w+|TRUNCATE\b|GRANT\b|REVOKE\b|LOCK\s+TABLES?\b|UNLOCK\s+TABLES?\b"
+        r"|BEGIN\b|START\s+TRANSACTION\b|(?:ANALYZE|CHECK|OPTIMIZE|REPAIR)\s+TABLE\b|FLUSH\b"
+        r"|(?:UN)?INSTALL\s+PLUGIN\b|SET\s+PASSWORD\b|SET\s+(?:SESSION\s+|@@)?autocommit\b",
+        re.I,
+    )
+
     def __init__(
         self,
         server_name: str,
@@ -41,7 +67,7 @@ class MySQLDatabase(Database):
         user_name: str | None,
         need_passwd: bool = False,
         port: int | None = 3306,
-        encoding: str | None = "latin1",
+        encoding: str | None = "utf8mb4",
         password: str | None = None,
     ) -> None:
         try:
@@ -52,18 +78,23 @@ class MySQLDatabase(Database):
             )
         from execsql.types import dbt_mysql
 
+        super().__init__(
+            server_name=str(server_name) if server_name is not None else None,
+            db_name=str(db_name) if db_name is not None else None,
+            user_name=str(user_name) if user_name is not None else None,
+            need_passwd=need_passwd,
+            port=port if port else 3306,
+        )
         self.type = dbt_mysql
-        self.server_name = str(server_name) if server_name is not None else None
-        self.db_name = str(db_name) if db_name is not None else None
-        self.user = str(user_name) if user_name is not None else None
-        self.need_passwd = need_passwd
         self.password = password
-        self.port = port if port else 3306
-        self.encoding = encoding or "latin1"
+        # utf8mb4, not latin1: the connection charset only governs how text moves
+        # between client and server, and MySQL transcodes to and from each
+        # column's own charset.  A latin1 connection cannot carry CJK, emoji,
+        # Greek, or Cyrillic at all — it raises UnicodeEncodeError before the
+        # server is reached — so it silently capped what execsql could move.
+        self.encoding = encoding or "utf8mb4"
         self.encode_commands = True
         self.paramstr = "%s"
-        self.conn = None
-        self.autocommit = True
         self.open_db()
         self.password = None  # Clear cleartext password after successful connection
 
@@ -297,8 +328,22 @@ class MySQLDatabase(Database):
                 if csv_file_obj.quotechar:
                     safe_quote = csv_file_obj.quotechar.replace("'", "''")
                     import_sql = f"{import_sql} optionally enclosed by '{safe_quote}'"
+            # Tell LOAD DATA what ends a line.  Its default is "\n", so a CRLF
+            # file left a carriage return on the last field of every row: the
+            # value was not empty, NULLIF below could not see it, and a date
+            # column silently became 0000-00-00.  Every other backend reads the
+            # same file correctly.
+            if _crlf_terminated(csv_file_obj.csvfname):
+                import_sql = f"{import_sql} lines terminated by '\\r\\n'"
             import_sql = f"{import_sql} ignore {1 + csv_file_obj.junk_header_lines} lines"
-            import_sql = f"{import_sql} ({input_col_list});"
+            # Read every column into a user variable and NULLIF it back.  LOAD
+            # DATA otherwise coerces an empty field to the column's zero value
+            # — an empty numeric became 0 and an empty date 0000-00-00 — so the
+            # same CSV imported to MySQL differed from every other backend,
+            # where an empty field is NULL.
+            vars_list = ",".join(f"@ecs_{i}" for i in range(len(import_cols)))
+            set_list = ",".join(f"{col}=nullif(@ecs_{i},'')" for i, col in enumerate(import_cols))
+            import_sql = f"{import_sql} ({vars_list}) set {set_list};"
             if _state.exec_log is not None:
                 _state.exec_log.log_status_info(
                     f"IMPORTing {csv_file_obj.csvfname} using the DBMS' fast file reading routine",

execsql/db/oracle.py

@@ -8,9 +8,11 @@ via the ``oracledb`` driver (python-oracledb).  Corresponds to ``-t o``
 on the CLI.
 """
 
+import re
 from typing import Any
 
 from execsql.db.base import Database
+from execsql.db.tiers import SupportTier
 from execsql.exceptions import ErrInfo
 from execsql.utils.errors import exception_desc, fatal_error
 from execsql.utils.auth import clear_stored_password, get_password, password_from_keyring
@@ -22,6 +24,18 @@ __all__ = ["OracleDatabase"]
 class OracleDatabase(Database):
     """Oracle adapter using the cx_Oracle (python-oracledb) driver."""
 
+    #: Oracle commits every DDL statement at once, together with everything
+    #: before it, including CREATE GLOBAL TEMPORARY TABLE.
+    implicit_commit_rx = re.compile(
+        r"(?:CREATE|ALTER|DROP)\s+(?:OR\s+REPLACE\s+)?(?:GLOBAL\s+TEMPORARY\s+|UNIQUE\s+|BITMAP\s+)?\w+"
+        r"|TRUNCATE\s+\w+|RENAME\b|GRANT\b|REVOKE\b|COMMENT\s+ON\b|(?:NO)?AUDIT\b|ANALYZE\b|PURGE\b|FLASHBACK\b",
+        re.I,
+    )
+
+    #: No Oracle server runs in CI; this adapter has no tests.
+    support_tier = SupportTier.BEST_EFFORT
+    support_tier_name = "Oracle"
+
     def __init__(
         self,
         server_name: str,
@@ -40,18 +54,18 @@ class OracleDatabase(Database):
             )
         from execsql.types import dbt_oracle
 
+        super().__init__(
+            server_name=server_name,
+            db_name=db_name,
+            user_name=user_name,
+            need_passwd=need_passwd,
+            port=port if port else 1521,
+        )
         self.type = dbt_oracle
-        self.server_name = server_name
-        self.db_name = db_name
-        self.user = user_name
-        self.need_passwd = need_passwd
         self.password = password
-        self.port = port if port else 1521
         self.encoding = encoding or "UTF8"
         self.encode_commands = False
         self.paramstr = ":1"
-        self.conn = None
-        self.autocommit = True
         self.open_db()
         self.password = None  # Clear cleartext password after successful connection
 
@@ -105,13 +119,12 @@ class OracleDatabase(Database):
                 msg = f"Failed to open Oracle database {self.db_name} on {self.server_name}"
                 raise ErrInfo(type="exception", exception_msg=exception_desc(), other_msg=msg) from e
 
-    def execute(self, sql: Any, paramlist: list | None = None) -> None:
+    def execute(self, sql: Any, paramlist: list | None = None, *, fetch: bool = False) -> tuple[list[str], list] | None:
         """Execute a SQL command, stripping any trailing semicolon for Oracle."""
         # Strip any semicolon off the end and pass to the parent method.
         if sql[-1:] == ";":
-            super().execute(sql[:-1], paramlist)
-        else:
-            super().execute(sql, paramlist)
+            return super().execute(sql[:-1], paramlist, fetch=fetch)
+        return super().execute(sql, paramlist, fetch=fetch)
 
     def select_data(self, sql: str) -> tuple[list[str], list]:
         """Return column names and all rows from a SELECT statement."""

execsql/db/postgres.py

@@ -49,20 +49,20 @@ class PostgresDatabase(Database):
             )
         from execsql.types import dbt_postgres
 
+        super().__init__(
+            server_name=server_name,
+            db_name=db_name,
+            user_name=user_name,
+            need_passwd=need_passwd,
+            port=port if port else 5432,
+            encoding=encoding or "UTF8",
+        )
         self.type = dbt_postgres
-        self.server_name = server_name
-        self.db_name = db_name
-        self.user = user_name
-        self.need_passwd = need_passwd
         self.password = password
-        self.port = port if port else 5432
         self.new_db = new_db
-        self.encoding = encoding or "UTF8"
         self.encode_commands = False
         self.paramstr = "%s"
         self.connect_timeout = connect_timeout
-        self.conn = None
-        self.autocommit = True
         self.open_db()
         self.password = None  # Clear cleartext password after successful connection
 
@@ -318,8 +318,16 @@ class PostgresDatabase(Database):
         input_enc = csv_file_obj.encoding.lower()
         if input_enc in enc_xlates:
             input_enc = enc_xlates[input_enc]
+        # COPY's CSV format always has a quote character — `"` unless told
+        # otherwise — so it cannot read a file that has none: with QUOTE NONE,
+        # or when none is detected, it would strip the `"` from `Well "A" 12`.
+        # Nor is it told about a detected escape character, so `\"` inside a
+        # quoted field came out as `\`. Both kinds of file take the row-by-row
+        # path, which reads the format that was detected.
         if (
-            encodings_match(input_enc, self.encoding)
+            csv_file_obj.quotechar is not None
+            and csv_file_obj.escapechar is None
+            and encodings_match(input_enc, self.encoding)
             and data_table_cols == csv_file_cols
             and _state.conf.empty_strings
             and _state.conf.empty_rows

execsql/db/sqlite.py

@@ -26,6 +26,10 @@ DEFAULT_CONNECT_TIMEOUT = 30  # seconds
 class SQLiteDatabase(Database):
     """SQLite adapter using the Python standard-library sqlite3 module."""
 
+    #: SQLite refuses VACUUM, ATTACH and DETACH inside a transaction, and
+    #: ignores some PRAGMAs there (``foreign_keys``).
+    no_transaction_rx = re.compile(r"(?:VACUUM|ATTACH|DETACH|PRAGMA)\b", re.I)
+
     def __init__(self, SQLite_fn: str, timeout: float = DEFAULT_CONNECT_TIMEOUT) -> None:
         try:
             import sqlite3  # noqa: F401
@@ -33,22 +37,33 @@ class SQLiteDatabase(Database):
             fatal_error("The sqlite3 module is required.")
         from execsql.types import dbt_sqlite
 
+        super().__init__(
+            server_name=None,
+            db_name=SQLite_fn,
+            user_name=None,
+            need_passwd=False,
+            encoding="UTF-8",
+        )
         self.type = dbt_sqlite
-        self.server_name = None
-        self.db_name = SQLite_fn
-        self.user = None
-        self.need_passwd = False
-        self.encoding = "UTF-8"
         self.encode_commands = False
-        self.paramstr = "?"
         self.timeout = timeout
-        self.conn = None
-        self.autocommit = True
         self.open_db()
 
     def __repr__(self) -> str:
         return f"SQLiteDatabase({self.db_name!r})"
 
+    def begin_transaction(self) -> None:
+        """Open a transaction if none is open.
+
+        Python's sqlite3 module opens one on its own only before INSERT,
+        UPDATE, DELETE and REPLACE.  Without this, a CREATE TABLE or DROP run
+        under AUTOCOMMIT OFF or in a batch would be committed at once.
+        """
+        if self.conn is None:
+            self.open_db()
+        if not self.conn.in_transaction:
+            self.conn.execute("BEGIN")
+
     def open_db(self) -> None:
         """Open a connection to the SQLite database file."""
         import sqlite3

execsql/db/sqlserver.py

@@ -37,18 +37,18 @@ class SqlServerDatabase(Database):
             fatal_error("The pyodbc module is required.  See http://github.com/mkleehammer/pyodbc")
         from execsql.types import dbt_sqlserver
 
+        super().__init__(
+            server_name=server_name,
+            db_name=db_name,
+            user_name=user_name,
+            need_passwd=need_passwd,
+            port=port if port else 1433,
+        )
         self.type = dbt_sqlserver
-        self.server_name = server_name
-        self.db_name = db_name
-        self.user = user_name
-        self.need_passwd = need_passwd
         self.password = password
-        self.port = port if port else 1433
         self.encoding = encoding or "latin1"  # Default on installation of SQL Server
         self.encode_commands = True
         self.paramstr = "?"
-        self.conn = None
-        self.autocommit = True
         self.open_db()
         self.password = None  # Clear cleartext password after successful connection
 

execsql/db/tiers.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+"""
+Database support tiers.
+
+execsql2 ships nine DBMS adapters, but only five of them are exercised
+against a live server (or a real database file) on every CI run.  The other
+four are carried forward from the upstream monolith and are not verified
+anywhere.  Documenting all nine with equal confidence tells users nothing
+about which ones have actually been run.
+
+:class:`SupportTier` records that distinction, each adapter declares its own
+tier via ``Database.support_tier``, and :func:`announce_tier` emits a single
+informational line the first time a session opens a Tier 2 connection.
+
+The notice is written to stderr (never stdout, so it cannot corrupt piped
+query output) and can be switched off with ``support_tier_notice=No`` in the
+``[interface]`` section of ``execsql.conf``.
+"""
+
+import enum
+
+import execsql.state as _state
+
+__all__ = ["SupportTier", "announce_tier"]
+
+
+class SupportTier(enum.Enum):
+    """How thoroughly a DBMS adapter is verified.
+
+    Attributes:
+        SUPPORTED: Tested against a live server or real database file on
+            every CI run.  Regressions block a release, and bugs are fixed.
+        BEST_EFFORT: Inherited from the upstream monolith and not verified
+            in CI.  The code is present and may work; nothing proves it
+            still does.  Issues and pull requests are welcome, but no
+            guarantee is made.
+    """
+
+    SUPPORTED = "supported"
+    BEST_EFFORT = "best effort"
+
+
+_NOTICE = (
+    "Note: {dbms} support is best-effort — it is not verified in CI and may break. "
+    "Set support_tier_notice=No in the [interface] section of execsql.conf to silence this."
+)
+
+
+def announce_tier(tier: SupportTier, dbms_name: str) -> None:
+    """Emit the best-effort notice for ``dbms_name``, at most once per session.
+
+    Silent for :attr:`SupportTier.SUPPORTED`, when the user has set
+    ``support_tier_notice=No``, and before output hooks are installed (which is
+    the case for adapters built by the test suite and by library callers that
+    have not started a run).
+
+    Which names have been announced is tracked on the runtime context, so
+    :func:`execsql.state.reset` clears it between runs and between tests, and a
+    script that opens twenty Firebird connections prints the notice once.
+
+    Args:
+        tier: The adapter's declared support tier.
+        dbms_name: Human-readable DBMS name used in the message.
+    """
+    if tier is not SupportTier.BEST_EFFORT:
+        return
+    conf = _state.conf
+    if conf is not None and not getattr(conf, "support_tier_notice", True):
+        return
+    shown = _state.tier_notices_shown
+    if dbms_name in shown:
+        return
+    shown.add(dbms_name)
+    message = _NOTICE.format(dbms=dbms_name)
+    if _state.exec_log is not None:
+        _state.exec_log.log_status_info(message)
+    if _state.output is not None:
+        _state.output.write_err(message)

execsql/exporters/delimited.py

@@ -386,6 +386,16 @@ class CsvFile(EncodedFile):
                 break
             except:
                 raise
+            # A quoted field may contain a newline — RFC 4180 allows it, and
+            # execsql's own CSV writer produces it.  Read on until the quotes
+            # balance, so diagnosis sees one logical record rather than two
+            # physical lines whose delimiter counts disagree; an odd count made
+            # the real delimiter look inconsistent and it was rejected.
+            while ln.count('"') % 2 == 1:
+                try:
+                    ln += next(linestream)
+                except StopIteration:
+                    break
             while len(ln) > 0 and ln[-1] in ("\n", "\r"):
                 ln = ln[:-1]
             if len(ln) > 0:
@@ -799,7 +809,11 @@ def write_delimited_file(
     else:
         fmode = "w" if not append else "a"
         filewriter_close(outfile)
-        ofile = EncodedFile(outfile, file_encoding).open(mode=fmode)
+        # newline="": a delimited field may legitimately contain a newline, and
+        # universal-newline translation would rewrite it to \r\n on Windows,
+        # changing the exported value.  Row terminators stay "\n" on every
+        # platform, so the same query now produces the same bytes everywhere.
+        ofile = EncodedFile(outfile, file_encoding).open(mode=fmode, newline="")
         fdesc = outfile
     try:
         if not (filefmt.lower() == "plain" or (append and zipfile is None)):

execsql/exporters/html.py

@@ -51,7 +51,10 @@ def export_html(
         for r in rows:
             f.write("<tr>")
             for v in r:
-                f.write(f"<td>{html_mod.escape(str(v)) if v else ''}</td>")
+                # `if v is not None`, not `if v`: 0, False, and an empty
+                # string are all falsy, and a zero measurement silently became
+                # an empty cell.
+                f.write(f"<td>{html_mod.escape(str(v)) if v is not None else ''}</td>")
             f.write("</tr>\n")
         f.write("</tbody>\n</table>\n")
 
@@ -191,7 +194,10 @@ def export_cgi_html(
         for r in rows:
             f.write("<tr>")
             for v in r:
-                f.write(f"<td>{html_mod.escape(str(v)) if v else ''}</td>")
+                # `if v is not None`, not `if v`: 0, False, and an empty
+                # string are all falsy, and a zero measurement silently became
+                # an empty cell.
+                f.write(f"<td>{html_mod.escape(str(v)) if v is not None else ''}</td>")
             f.write("</tr>\n")
         f.write("</tbody>\n</table>\n")
 

execsql/exporters/latex.py

@@ -20,6 +20,39 @@ import execsql.state as _state
 __all__ = ["export_latex", "write_query_to_latex"]
 
 
+#: Every character LaTeX treats specially, with its text-mode replacement.
+#: ``&`` matters most here: it is the column separator this exporter writes, so
+#: an ampersand in a value silently added a column and the .tex file no longer
+#: compiled.  ``%`` is nearly as bad — it comments out the rest of the line.
+#: str.translate applies these simultaneously, so the backslash replacement
+#: cannot be re-escaped by a later rule.
+_LATEX_ESCAPE = str.maketrans(
+    {
+        "\\": r"\textbackslash{}",
+        "&": r"\&",
+        "%": r"\%",
+        "$": r"\$",
+        "#": r"\#",
+        "_": r"\_",
+        "{": r"\{",
+        "}": r"\}",
+        "~": r"\textasciitilde{}",
+        "^": r"\textasciicircum{}",
+    },
+)
+
+
+def _latex_cell(value: Any) -> str:
+    """Render a value as LaTeX table-cell text.
+
+    ``None`` becomes an empty cell rather than the literal string "None",
+    matching every other exporter.
+    """
+    if value is None:
+        return ""
+    return str(value).translate(_LATEX_ESCAPE)
+
+
 def export_latex(
     outfile: str,
     hdrs: list[str],
@@ -39,10 +72,10 @@ def export_latex(
             f.write(f"  \\caption{{{desc}}}\n")
         f.write(f"  \\begin{{tabular}} {{{' l' * len(hdrs)} }}\n")
         f.write("  \\hline\n")
-        f.write("  " + " & ".join([h.replace("_", r"\_") for h in hdrs]) + " \\\\\n")
+        f.write("  " + " & ".join([_latex_cell(h) for h in hdrs]) + " \\\\\n")
         f.write("  \\hline\n")
         for r in rows:
-            f.write("  " + " & ".join([str(c).replace("_", r"\_") for c in r]) + " \\\\\n")
+            f.write("  " + " & ".join([_latex_cell(c) for c in r]) + " \\\\\n")
         f.write("  \\hline\n")
         f.write("  \\end{tabular}\n")
         f.write("  \\end{table}\n")

execsql/exporters/markdown.py

@@ -35,15 +35,21 @@ def _cell(value: Any) -> str:
 
     Args:
         value: The cell value from the result set.  ``None`` is rendered as
-            an empty string.  Pipe characters are escaped so they do not
-            break the table structure.
+            an empty string.  Pipe characters are escaped, and newlines
+            become ``<br>``, so neither breaks the table structure.
 
     Returns:
         A string safe to embed between pipe characters in a GFM table row.
     """
     if value is None:
         return ""
-    return str(value).translate(_PIPE_ESCAPE)
+    text = str(value).translate(_PIPE_ESCAPE)
+    if "\n" in text or "\r" in text:
+        # A GFM table row is one line: a literal newline ends the row mid-cell
+        # and leaves the rest of the values outside the table entirely. <br> is
+        # how GFM expresses a line break inside a cell.
+        text = text.replace("\r\n", "\n").replace("\r", "\n").replace("\n", "<br>")
+    return text
 
 
 def write_query_to_markdown(

execsql/exporters/ods.py

@@ -10,6 +10,7 @@ Provides :func:`write_query_to_ods` (single-sheet export),
 """
 
 import datetime
+import decimal
 import getpass
 import os
 from pathlib import Path
@@ -239,7 +240,12 @@ class OdsFile:
             if isinstance(item, bool):
                 # Booleans must be evaluated before numbers.
                 tc = of.table.TableCell(valuetype="boolean", value=1 if item else 0, stylename=style_name)
-            elif isinstance(item, float | int):
+            elif isinstance(item, float | int | decimal.Decimal):
+                # Decimal belongs here: PostgreSQL, MySQL and DuckDB all return it
+                # for numeric/decimal columns.  Without it the value fell to the
+                # untyped branch below and the cell was written with an
+                # office:value but no office:value-type, which is not valid ODF —
+                # a reader is free to treat the number as text or ignore it.
                 tc = of.table.TableCell(valuetype="float", value=item, stylename=style_name)
             elif isinstance(item, datetime.datetime):
                 self.define_iso_datetime_style()
@@ -266,12 +272,24 @@ class OdsFile:
                 tc = of.table.TableCell(timevalue=timeval.strftime("PT%HH%MM%S.%fS"), stylename="iso_datetime")
                 tc.addElement(of.text.P(text=timeval.strftime("%H:%M:%S.%f")))
             elif isinstance(item, str):
-                item = item.replace("\n", " ").replace("\r", " ")
-                tc = of.table.TableCell(valuetype="string", stringvalue=item, stylename=style_name)
+                # An XML parser normalises a newline inside an attribute to a
+                # space, so office:string-value cannot carry one.  ODF's answer
+                # is one <text:p> per line, which is what LibreOffice writes;
+                # the attribute is set only for single-line values.
+                if "\n" in item or "\r" in item:
+                    tc = of.table.TableCell(valuetype="string", stylename=style_name)
+                else:
+                    tc = of.table.TableCell(valuetype="string", stringvalue=item, stylename=style_name)
             else:
                 tc = of.table.TableCell(value=item, stylename=style_name)
             if item is not None:
-                tc.addElement(of.text.P(text=item))
+                if isinstance(item, str) and ("\n" in item or "\r" in item):
+                    # Previously these were flattened to spaces, silently changing
+                    # the exported value.
+                    for line in item.replace("\r\n", "\n").replace("\r", "\n").split("\n"):
+                        tc.addElement(of.text.P(text=line))
+                else:
+                    tc.addElement(of.text.P(text=item))
             tr.addElement(tc)
 
     def add_sheet(self, of_table: Any) -> None:

execsql/exporters/pretty.py

@@ -36,6 +36,19 @@ def prettyprint_rowset(
         if s is None:
             return and_val
         if isinstance(s, str):
+            # A newline or tab inside a value destroys a fixed-width table: the
+            # row is split across physical lines and every column after it is
+            # misaligned.  This is a display format, so they are shown as their
+            # two-character escapes — the row stays one line, the columns line
+            # up, and the reader can still see that a break is there.
+            if "\n" in s or "\r" in s or "\t" in s:
+                return (
+                    s.replace("\\", "\\\\")
+                    .replace("\r\n", "\\n")
+                    .replace("\r", "\\r")
+                    .replace("\n", "\\n")
+                    .replace("\t", "\\t")
+                )
             return s
         if type(s) in (type(memoryview(b"")), bytes, bytearray):
             return f"Binary data ({len(s)} bytes)"

execsql/exporters/templates.py

@@ -105,7 +105,24 @@ class JinjaTemplateReport:
         inf = EncodedFile(template_file, conf.script_encoding)
         fh = inf.open("r")
         try:
-            self.template = SandboxedEnvironment().from_string(fh.read())
+            # Autoescape by template extension.  The sandbox guards against a
+            # hostile *template*; nothing guarded against hostile *data*, so a
+            # value from the database rendered into an .html report as live
+            # markup — a `<script>` in a text column became a script tag.
+            # Keying on the extension leaves every non-markup template (csv,
+            # tex, txt, sql) byte-identical; only html/htm/xml change, and a
+            # template that genuinely wants raw markup asks for it with the
+            # standard `{{ value|safe }}`.
+            autoescape = self._jinja2.select_autoescape(
+                enabled_extensions=("html", "htm", "xml"),
+                default_for_string=False,
+                default=False,
+            )
+            env = SandboxedEnvironment(autoescape=autoescape)
+            # from_string() has no filename to inspect, so resolve the policy
+            # against the template's own path and pass the decision through.
+            env.autoescape = autoescape(template_file)
+            self.template = env.from_string(fh.read())
         finally:
             fh.close()
 

execsql/exporters/values.py

@@ -8,6 +8,7 @@ set as a series of SQL ``INSERT INTO … VALUES (…)`` statements, suitable
 for loading data into a database from a plain SQL file.
 """
 
+import decimal
 from typing import Any
 
 import execsql.state as _state
@@ -19,6 +20,29 @@ from execsql.utils.fileio import filewriter_close
 __all__ = ["export_values", "write_query_to_values"]
 
 
+def _sql_literal(value: Any) -> str:
+    """Render a value as a SQL literal for an INSERT ... VALUES list.
+
+    Only numbers are emitted bare.  Everything else is quoted, with embedded
+    single quotes doubled — the SQL standard escape.
+
+    Quoting is the safe default rather than the exception.  Previously anything
+    that was not a string went out through ``str()`` unquoted, so a date became
+    ``2026-09-24``, which SQL reads as arithmetic: PostgreSQL inserted 1993 and
+    reported no error at all.  A timestamp, carrying a space, was a syntax
+    error instead.  Any type this function has not been taught about is safer
+    quoted than bare.
+    """
+    if value is None:
+        return "NULL"
+    if isinstance(value, bool):
+        # Checked before int — bool is a subclass of it.
+        return "TRUE" if value else "FALSE"
+    if isinstance(value, int | float | decimal.Decimal):
+        return str(value)
+    return "'" + str(value).replace("'", "''") + "'"
+
+
 def export_values(
     outfile: str,
     hdrs: list[str],
@@ -54,10 +78,7 @@ def export_values(
                 firstrow = False
             else:
                 f.write(",\n")
-            quoted_row = [
-                f"'{v.replace(chr(39), chr(39) * 2)}'" if isinstance(v, str) else str(v) if v is not None else "NULL"
-                for v in r
-            ]
+            quoted_row = [_sql_literal(v) for v in r]
             f.write(f"    ({', '.join(quoted_row)})")
         f.write("\n    ;\n")
     finally: