execsql2 2.30.0__py3-none-any.whl → 2.31.1__py3-none-any.whl

execsql/api.py

@@ -297,6 +297,7 @@ def _connect_from_dsn(dsn: str, new_db: bool = False) -> Any:
             user=user,
             password=password,
             port=port,
+            trust_server_certificate=params["trust_server_certificate"],
         )
     elif db_type == "o":
         return db_Oracle(

execsql/cli/application.py

@@ -282,7 +282,7 @@ def _online_help_callback(value: bool) -> None:
     if value:
         import webbrowser
 
-        webbrowser.open("https://execsql2.readthedocs.io/en/latest/", new=2, autoraise=True)
+        webbrowser.open("https://execsql2.readthedocs.io/en/stable/", new=2, autoraise=True)
         raise typer.Exit()
 
 

execsql/cli/commands/lint.py

@@ -143,7 +143,7 @@ class LintFormat(str, Enum):
         "Every issue names its rule code, which --select and --ignore accept, as a full "
         "code (V001) or a prefix (V). Parse errors (P001) are always reported. Exits 1 "
         "when any error is found; warnings alone exit 0 unless --strict is given.\n\n"
-        "Rules: https://execsql2.readthedocs.io/en/latest/reference/lint/"
+        "Rules: https://execsql2.readthedocs.io/en/stable/reference/lint/"
     ),
 )
 def lint_cmd(

execsql/cli/dsn.py

@@ -40,7 +40,9 @@ def _parse_connection_string(dsn: str) -> dict:
     written ``%40``, ``%3A``, ``%2F``, ``%3F``, ``%23``, ``%25``.
 
     Returns a dict with keys: ``db_type``, ``server``, ``db``, ``db_file``,
-    ``user``, ``password``, ``port``.  Absent components are ``None``.
+    ``user``, ``password``, ``port`` and ``trust_server_certificate`` (from
+    ``?trust_server_certificate=yes`` on an ``mssql://`` URL).  Absent
+    components are ``None``.
 
     Raises :class:`~execsql.exceptions.ConfigError` for an unrecognised
     URL scheme or a completely un-parseable string.
@@ -86,6 +88,8 @@ def _parse_connection_string(dsn: str) -> dict:
         # Remove leading "/"
         db = raw_path.lstrip("/") or None
 
+    trust_server_certificate = _query_options(parsed.query, db_type)
+
     return {
         "db_type": db_type,
         "server": server,
@@ -94,4 +98,34 @@ def _parse_connection_string(dsn: str) -> dict:
         "user": user,
         "password": password,
         "port": port,
+        "trust_server_certificate": trust_server_certificate,
     }
+
+
+_TRUE = ("yes", "true", "on", "1")
+_FALSE = ("no", "false", "off", "0")
+
+
+def _query_options(query: str, db_type: str) -> bool | None:
+    """Return ``trust_server_certificate`` from a DSN's query string, or None if absent.
+
+    It is the only query parameter execsql reads, and only for SQL Server.
+    Anything else is an error rather than ignored, so a misspelt option
+    cannot silently leave a connection without the setting it asked for.
+    """
+    from urllib.parse import parse_qsl
+
+    trust: bool | None = None
+    for key, value in parse_qsl(query, keep_blank_values=True):
+        if key.lower() != "trust_server_certificate" or db_type != "s":
+            raise ConfigError(
+                f"Unrecognised connection-string parameter {key!r}. "
+                "The only one execsql reads is trust_server_certificate, for mssql:// URLs.",
+            )
+        if value.lower() in _TRUE:
+            trust = True
+        elif value.lower() in _FALSE:
+            trust = False
+        else:
+            raise ConfigError(f"trust_server_certificate must be yes or no, not {value!r}.")
+    return trust

execsql/cli/lint.py

@@ -56,6 +56,7 @@ from collections.abc import Iterable
 from pathlib import Path
 from typing import TYPE_CHECKING, NamedTuple
 
+from execsql.utils.paths import is_network_path
 from execsql.exceptions import ErrInfo
 from execsql.script.ast import (
     BatchBlock,
@@ -461,6 +462,8 @@ def _read_ini_vars(
     language server; a file that is unreadable or not valid INI defines
     nothing.
     """
+    if is_network_path(ini_file):  # see _check_include_path
+        return
     p = Path(ini_file)
     if not p.is_absolute() and script_dir is not None:
         p = script_dir / p
@@ -582,7 +585,13 @@ def _check_include_path(
     line_no: int,
     issues: list[_Issue],
 ) -> None:
-    """Warn if the INCLUDE target does not exist on disk."""
+    """Warn if the INCLUDE target does not exist on disk.
+
+    A target written as a network path is not checked: on Windows, even
+    asking whether it exists contacts the host it names.
+    """
+    if is_network_path(raw_path):
+        return
     p = Path(raw_path)
     if not p.is_absolute() and script_dir is not None:
         p = script_dir / p

execsql/cli/run.py

@@ -281,6 +281,7 @@ def _load_config(
     subvars: SubVarSet,
     config_file: str | None,
     start_dir: str | None = None,
+    local_only: bool = False,
 ) -> ConfigData:
     """Load and merge configuration files for the given script.
 
@@ -291,7 +292,7 @@ def _load_config(
         script_path = str(Path(script_name).resolve().parent)
     else:  # resolved, as os.getcwd() is, so the start directory's execsql.conf is not read twice
         script_path = str(Path(start_dir).resolve()) if start_dir else os.getcwd()
-    return ConfigData(script_path, subvars, config_file=config_file, start_dir=start_dir)
+    return ConfigData(script_path, subvars, config_file=config_file, start_dir=start_dir, local_only=local_only)
 
 
 def _tool_config(config_file: str | None, start_dir: str | None = None) -> ConfigData:
@@ -301,9 +302,11 @@ def _tool_config(config_file: str | None, start_dir: str | None = None) -> Confi
     locations plus *config_file* — not per script, so a script directory's
     own ``execsql.conf`` applies only when passed with ``--config``.  The
     language server passes a workspace folder as *start_dir*: the settings
-    those commands would read when run from it.
+    those commands would read when run from it.  Config chains written as
+    network paths are skipped untouched (``local_only``): these tools read
+    config from repositories other people write.
     """
-    return _load_config(None, _seed_early_subvars(start_dir), config_file, start_dir)
+    return _load_config(None, _seed_early_subvars(start_dir), config_file, start_dir, local_only=True)
 
 
 def _configured_script_encoding(conf: ConfigData) -> str | None:
@@ -366,6 +369,8 @@ def _apply_dsn(dsn: str, conf: ConfigData, db_type: str | None) -> tuple[str | N
         conf.db = parsed["db"]
     if parsed["db_file"]:
         conf.db_file = parsed["db_file"]
+    if parsed["trust_server_certificate"] is not None:
+        conf.trust_server_certificate = parsed["trust_server_certificate"]
     user = parsed["user"]  # may be None
     if parsed["password"]:
         conf.db_password = parsed["password"]

execsql/config.py

@@ -23,6 +23,7 @@ from configparser import ConfigParser
 from pathlib import Path
 from typing import Protocol
 
+from execsql.utils.paths import is_network_path
 from execsql.exceptions import ConfigError, ConfigFileError
 from execsql.utils.crypto import Encrypt
 
@@ -281,6 +282,7 @@ class ConfigData:
         self._get_bool(cp, self._CONNECT_SECTION, "password_prompt", "passwd_prompt")
         self._get_bool(cp, self._CONNECT_SECTION, "use_keyring", "use_keyring")
         self._get_bool(cp, self._CONNECT_SECTION, "new_db", "new_db")
+        self._get_bool(cp, self._CONNECT_SECTION, "trust_server_certificate", "trust_server_certificate")
         # --- [encoding] ---
         self._get_str(cp, self._ENCODING_SECTION, "database", "db_encoding")
         self._get_str(cp, self._ENCODING_SECTION, "script", "script_encoding", required=True)
@@ -402,6 +404,7 @@ class ConfigData:
         *,
         config_file: str | None = None,
         start_dir: str | None = None,
+        local_only: bool = False,
     ) -> None:
         """Load and merge all discoverable execsql.conf files for the given script path.
 
@@ -420,8 +423,13 @@ class ConfigData:
                 ``[config]`` chains) resolve against it.  Defaults to the
                 working directory.  The language server passes each
                 workspace folder, so it never changes the process's directory.
+            local_only: Skip a ``config_file`` chain or ``[include_*]`` path
+                written as a network path (:func:`~execsql.utils.paths.is_network_path`)
+                without touching it.  The static tools pass it: they read
+                config files a cloned repository may supply.
         """
         self._start_dir = start_dir
+        self._local_only = local_only
         self._set_defaults()
         current_script = str(Path(sys.argv[0]).resolve())
         from collections import deque
@@ -464,6 +472,8 @@ class ConfigData:
 
     #: Where relative paths resolve; ``None`` is the working directory.
     _start_dir: str | None = None
+    #: Whether paths written as network paths are skipped (see ``__init__``).
+    _local_only: bool = False
 
     #: Guard against circular config_file references.
     _MAX_CONFIG_CHAIN = 20
@@ -481,6 +491,7 @@ class ConfigData:
         self.use_keyring = True
         self.db_file: str | None = None
         self.new_db = False
+        self.trust_server_certificate = False
         self.user_logfile = False
         self.db_encoding: str | None = None
         self.script_encoding = "utf8"
@@ -602,12 +613,15 @@ class ConfigData:
         *,
         expand_home: bool,
         start_dir: str | None = None,
+        local_only: bool = False,
     ) -> str:
         """Resolve a ``config_file``-style value to the file it names.
 
         A leading ``~`` is expanded when *expand_home* is true, substitution
         variables are replaced, and a directory means the ``execsql.conf``
         inside it. The result may not exist; callers decide what that means.
+        With *local_only*, a value that is a network path once substituted
+        gives ``""`` without being touched.
         """
         conffile = value
         if expand_home and conffile and conffile[0] == "~":
@@ -616,12 +630,18 @@ class ConfigData:
             elif len(conffile) > 1 and conffile[1] == os.sep:
                 conffile = str(Path("~").expanduser() / conffile[2:])
         conffile = variable_pool.substitute(conffile)[0]
+        if local_only and is_network_path(conffile):
+            return ""
         if start_dir and not Path(conffile).is_absolute():
             conffile = str(Path(start_dir) / conffile)
         if not Path(conffile).is_file():
             conffile = str(Path(conffile) / cls.config_file_name)
         return conffile
 
+    def _skips(self, path: str) -> bool:
+        """Whether *path* is left untouched: a network path when ``local_only``."""
+        return self._local_only and is_network_path(path)
+
     def _apply_file(self, cp: ConfigParser, variable_pool: _VariablePool, current_script: str) -> list[str]:
         """Apply one parsed config file to ``self``; return the files it chains to.
 
@@ -672,8 +692,9 @@ class ConfigData:
                 variable_pool,
                 expand_home=os.name == "posix",
                 start_dir=self._start_dir,
+                local_only=self._local_only,
             )
-            if Path(conffile).is_file():
+            if conffile and Path(conffile).is_file():
                 # Silently ignore a non-existent file, for cross-OS compatibility.
                 chained.append(conffile)
         # OS-specific additional config files.
@@ -690,8 +711,9 @@ class ConfigData:
                 variable_pool,
                 expand_home=True,
                 start_dir=self._start_dir,
+                local_only=self._local_only,
             )
-            if Path(conffile).is_file():
+            if conffile and Path(conffile).is_file():
                 chained.append(conffile)
         # dao_flush_delay_secs has a specific error message — keep inline
         if cp.has_option(self._CONFIG_SECTION, "dao_flush_delay_secs"):
@@ -727,7 +749,7 @@ class ConfigData:
         if cp.has_section(self._INCLUDE_REQ_SECTION):
             imp_items = cp.items(self._INCLUDE_REQ_SECTION)
             ord_items = sorted([(int(i[0]), i[1]) for i in imp_items], key=lambda x: x[0])
-            newfiles = [str(Path(f[1]).resolve()) for f in ord_items]
+            newfiles = [str(Path(f[1]).resolve()) for f in ord_items if not self._skips(f[1])]
             u_files = []
             for f in newfiles:
                 if not (f in u_files or f in self.include_req or f in self.include_opt) and f != current_script:
@@ -738,7 +760,7 @@ class ConfigData:
         if cp.has_section(self._INCLUDE_OPT_SECTION):
             imp_items = cp.items(self._INCLUDE_OPT_SECTION)
             ord_items = sorted([(int(i[0]), i[1]) for i in imp_items], key=lambda x: x[0])
-            newfiles = [str(Path(f[1]).resolve()) for f in ord_items]
+            newfiles = [str(Path(f[1]).resolve()) for f in ord_items if not self._skips(f[1])]
             u_files = []
             for f in newfiles:
                 if (

execsql/data/execsql.conf.template

@@ -1,6 +1,6 @@
 # execsql.conf — Configuration file for execsql
 #
-# Documentation: https://execsql2.readthedocs.io/en/latest/reference/configuration/
+# Documentation: https://execsql2.readthedocs.io/en/stable/reference/configuration/
 #
 # This file uses INI format. Section names are case-sensitive (lowercase).
 # Property names are not case-sensitive. Lines starting with # are comments.
@@ -54,6 +54,12 @@
 # Values: Yes or No.  Default: No.
 #new_db=No
 
+# SQL Server only: accept the server's TLS certificate without verifying it,
+# for a server with a self-signed certificate.  ODBC Driver 18 otherwise
+# refuses one it cannot verify.  Applies to CONNECT as well.
+# Values: Yes or No.  Default: No.
+#trust_server_certificate=No
+
 
 [encoding]
 # Character encoding for text input and output.
@@ -279,7 +285,7 @@
 #message_css=
 
 # Obfuscated password (XOR, not cryptographically secure — use keyring instead).
-# See: https://execsql2.readthedocs.io/en/latest/reference/security/#credentials
+# See: https://execsql2.readthedocs.io/en/stable/reference/security/#credentials
 #enc_password=
 
 

execsql/db/access.py

@@ -15,6 +15,7 @@ from pathlib import Path
 from typing import Any, cast
 
 from execsql.db.base import Database, _fetched
+from execsql.db.odbc import odbc_value
 from execsql.db.tiers import SupportTier
 from execsql.exceptions import ErrInfo
 from execsql.utils.errors import exception_desc, fatal_error, install_hint
@@ -119,10 +120,11 @@ class AccessDatabase(Database):
         def _try_odbc_drivers():
             db_name = str(Path(self.db_name).resolve())
             for cs, jet4flag in self.connection_strings:
+                connstr = cs % odbc_value(db_name)
+                logstr = connstr
                 if self.need_passwd:
-                    connstr = f"{cs % db_name} Uid={self.user}; Pwd={self.password};"
-                else:
-                    connstr = cs % db_name
+                    connstr += f" Uid={odbc_value(self.user)}; Pwd={odbc_value(self.password)};"
+                    logstr += f" Uid={odbc_value(self.user)}; Pwd=***;"
                 try:
                     # Access is file-based but a UNC path on an
                     # unreachable share can still block forever; cap
@@ -133,12 +135,12 @@ class AccessDatabase(Database):
                     errors.append(e)
                     if _state.exec_log is not None:
                         _state.exec_log.log_status_info(
-                            f"Could not connect via ODBC using: {re.sub(r'Pwd=[^;]*', 'Pwd=***', connstr)}",
+                            f"Could not connect via ODBC using: {logstr}",
                         )
                 else:
                     if _state.exec_log is not None:
                         _state.exec_log.log_status_info(
-                            f"Connected via ODBC using: {re.sub(r'Pwd=[^;]*', 'Pwd=***', connstr)}",
+                            f"Connected via ODBC using: {logstr}",
                         )
                     self.jet4 = jet4flag
                     return True

execsql/db/base.py

@@ -641,6 +641,24 @@ class Database(ABC):
 
         raise DatabaseNotImplementedError(self.name(), "role_exists")
 
+    def drop_table_for_replacement(self, schema_name: str | None, table_name: str) -> None:
+        """Drop the table a ``TO REPLACEMENT`` import or copy is about to recreate, if it is there.
+
+        Not every DBMS has ``DROP TABLE IF EXISTS``: SQL Server, Oracle,
+        Firebird and Access refuse to drop a table that does not exist.  The
+        drop is tried first, and its error is ignored only when the table is
+        confirmed absent, so a drop that would have succeeded always runs.
+        """
+        try:
+            self.drop_table(self.schema_qualified_table_name(schema_name, table_name))
+        except Exception:
+            try:
+                there = self.table_exists_where_created(table_name, schema_name)
+            except Exception:
+                there = True
+            if there:
+                raise
+
     def drop_table(self, tablename: str) -> None:
         """Drop *tablename* if it exists; *tablename* must already be schema-qualified and quoted."""
         # The 'tablename' argument should be schema-qualified and quoted as necessary.

execsql/db/factory.py

@@ -106,9 +106,19 @@ def db_SqlServer(
     port: int | None = None,
     encoding: str | None = None,
     password: str | None = None,
+    trust_server_certificate: bool | None = None,
 ) -> SqlServerDatabase:
     """Open a Microsoft SQL Server connection via pyodbc."""
-    return SqlServerDatabase(server_name, database_name, user, pw_needed, port, encoding, password=password)
+    return SqlServerDatabase(
+        server_name,
+        database_name,
+        user,
+        pw_needed,
+        port,
+        encoding,
+        password=password,
+        trust_server_certificate=trust_server_certificate,
+    )
 
 
 def db_MySQL(

execsql/db/mysql.py

@@ -7,7 +7,9 @@ Implements :class:`MySQLDatabase`, which connects to MySQL and MariaDB
 servers via ``pymysql``.  Corresponds to ``-t m`` on the CLI.
 """
 
+import os
 import re
+import tempfile
 from typing import Any, cast
 
 from execsql.db.base import Database
@@ -53,6 +55,49 @@ def _crlf_terminated(filename: str) -> bool:
     return i > 0 and chunk[i - 1 : i] == b"\r"
 
 
+def _data_length(filename: str) -> int | None:
+    """Return the file's length without its trailing blank lines, or None if it has none.
+
+    LOAD DATA reads each blank line at the end of a file as a row of NULLs;
+    every other import path drops them.  The file is read backwards from the
+    end, as bytes, so no decoding can hide a line ending.
+    """
+    try:
+        with open(filename, "rb") as f:
+            size = f.seek(0, 2)
+            pos = size
+            content_end = 0
+            while pos > 0:
+                start = max(0, pos - 65536)
+                f.seek(start)
+                block = f.read(pos - start)
+                stripped = len(block.rstrip(b"\r\n"))
+                if stripped:
+                    content_end = start + stripped
+                    break
+                pos = start
+            f.seek(content_end)
+            ending = f.read(2)
+    except OSError:
+        return None
+    # Keep the line ending of the last line of data.
+    keep = content_end + (2 if ending == b"\r\n" else 1 if ending[:1] in (b"\r", b"\n") else 0)
+    return keep if keep < size else None
+
+
+def _copy_head(filename: str, length: int) -> str:
+    """Copy the first *length* bytes of *filename* to a temporary file; return its path."""
+    with open(filename, "rb") as src, tempfile.NamedTemporaryFile("wb", suffix=".csv", delete=False) as dst:
+        remaining = length
+        while remaining > 0:
+            chunk = src.read(min(remaining, 1 << 20))
+            if not chunk:
+                break
+            dst.write(chunk)
+            remaining -= len(chunk)
+    return dst.name
+
+
 class MySQLDatabase(Database):
     """MySQL and MariaDB adapter using the pymysql package."""
 
@@ -353,7 +398,11 @@ class MySQLDatabase(Database):
             # String literals in this session treat a backslash as an escape,
             # so the file name, delimiter and quote character are quoted with
             # quote_literal, which doubles it.
-            import_sql = f"load data local infile {self.quote_literal(csv_file_obj.csvfname)} into table {sq_name}"
+            load_file = csv_file_obj.csvfname
+            data_length = _data_length(load_file)
+            if data_length is not None:
+                load_file = _copy_head(load_file, data_length)
+            import_sql = f"load data local infile {self.quote_literal(load_file)} into table {sq_name}"
             if csv_file_obj.encoding:
                 charset = _PYTHON_TO_MYSQL_CHARSET.get(csv_file_obj.encoding.lower(), csv_file_obj.encoding)
                 import_sql = f"{import_sql} character set {charset}"
@@ -385,7 +434,11 @@ class MySQLDatabase(Database):
                 _state.exec_log.log_status_info(
                     f"IMPORTing {csv_file_obj.csvfname} using the DBMS' fast file reading routine",
                 )
-            self.execute(import_sql)
+            try:
+                self.execute(import_sql)
+            finally:
+                if load_file != csv_file_obj.csvfname:
+                    os.unlink(load_file)
         else:
             data_indexes = [csv_file_cols.index(col) for col in import_cols]
             paramspec = ",".join(["%s"] * len(import_cols))
@@ -450,7 +503,7 @@ class MySQLDatabase(Database):
                                             if not _state.conf.empty_strings and line[i].strip() == "":
                                                 line[i] = None
                                 # Pad short line with nulls
-                                line.extend([None] * (len(import_cols) - len(line)))
+                                line.extend([None] * (len(csv_file_cols) - len(line)))
                                 linedata = [line[ix] for ix in data_indexes]
                                 add_line = True
                                 if not _state.conf.empty_rows:

execsql/db/odbc.py

@@ -0,0 +1,45 @@
+"""
+ODBC connection strings for the SQL Server and Access adapters.
+
+An ODBC connection string is a ``;``-separated list of ``KEY=value``
+attributes, so a value containing ``;`` (a password, a file path, a name
+taken from a substitution variable) would end its attribute early and
+start another.  :func:`odbc_value` brace-quotes such values;
+:func:`connection_string` joins the attributes, and :func:`loggable`
+gives the same string with the password masked for the log.
+"""
+
+from __future__ import annotations
+
+__all__ = ["connection_string", "loggable", "odbc_value"]
+
+_SECRET_KEYS = frozenset({"pwd", "password"})
+
+
+def odbc_value(value: object) -> str:
+    """Return *value* as an ODBC attribute value, brace-quoted when it needs it.
+
+    A ``;`` ends an attribute and a leading ``{`` opens a quoted value, so a
+    value with either is wrapped in ``{…}`` with each ``}`` doubled.  Other
+    values are written as they are, because older drivers do not all accept
+    braces around every attribute.
+    """
+    text = str(value)
+    if ";" in text or text.startswith("{"):
+        return "{" + text.replace("}", "}}") + "}"
+    return text
+
+
+def connection_string(driver: str, attributes: list[tuple[str, object]]) -> str:
+    """Return ``DRIVER={driver};KEY=value;…`` with every value quoted as needed."""
+    parts = [f"DRIVER={{{driver}}}"]
+    parts.extend(f"{key}={odbc_value(value)}" for key, value in attributes)
+    return ";".join(parts) + ";"
+
+
+def loggable(driver: str, attributes: list[tuple[str, object]]) -> str:
+    """Return the connection string with the password replaced by ``***``."""
+    return connection_string(
+        driver,
+        [(key, "***" if key.lower() in _SECRET_KEYS else value) for key, value in attributes],
+    )

execsql/db/postgres.py

@@ -462,7 +462,7 @@ class PostgresDatabase(Database):
                                             if not _state.conf.empty_strings and line[i].strip() == "":
                                                 line[i] = None
                                 # Pad short line with nulls
-                                line.extend([None] * (len(import_cols) - len(line)))
+                                line.extend([None] * (len(csv_file_cols) - len(line)))
                                 linedata = [line[ix] for ix in data_indexes]
                                 add_line = True
                                 if not _state.conf.empty_rows:

execsql/db/sqlserver.py

@@ -7,9 +7,8 @@ Implements :class:`SqlServerDatabase`, which connects to Microsoft SQL
 Server via ``pyodbc``.  Corresponds to ``-t s`` on the CLI.
 """
 
-import re
-
 from execsql.db.base import Database
+from execsql.db.odbc import connection_string, loggable
 from execsql.exceptions import ErrInfo
 from execsql.utils.errors import fatal_error, install_hint
 from execsql.utils.auth import (
@@ -34,9 +33,10 @@ class SqlServerDatabase(Database):
         db_name: str,
         user_name: str | None,
         need_passwd: bool = False,
-        port: int | None = 1433,
+        port: int | None = None,
         encoding: str | None = "latin1",
         password: str | None = None,
+        trust_server_certificate: bool | None = None,
     ) -> None:
         try:
             import pyodbc  # noqa: F401
@@ -51,6 +51,15 @@ class SqlServerDatabase(Database):
             need_passwd=need_passwd,
             port=port if port else 1433,
         )
+        # Only a port that was asked for goes into the connection string: a
+        # named instance (``host\instance``) is found through SQL Server
+        # Browser, which an explicit port bypasses.
+        self.explicit_port = port or None
+        # None: the [connect] trust_server_certificate setting, which also
+        # covers connections a script opens with CONNECT.
+        if trust_server_certificate is None:
+            trust_server_certificate = bool(getattr(_state.conf, "trust_server_certificate", False))
+        self.trust_server_certificate = trust_server_certificate
         self.type = dbt_sqlserver
         self.password = password
         self.encoding = encoding or "latin1"  # Default on installation of SQL Server
@@ -79,6 +88,12 @@ class SqlServerDatabase(Database):
         """
         return "[" + identifier.replace("]", "]]") + "]"
 
+    def _server_attribute(self) -> str:
+        """Return the ``SERVER`` value: ``host,port`` when a port was given."""
+        if self.explicit_port and "," not in self.server_name:
+            return f"{self.server_name},{self.explicit_port}"
+        return str(self.server_name)
+
     def open_db(self) -> None:
         """Open a connection to the SQL Server database via pyodbc."""
         import pyodbc
@@ -95,6 +110,7 @@ class SqlServerDatabase(Database):
                 )
             # Use pyodbc to connect.  Try different driver versions from newest to oldest.
             ssdrivers = (
+                "ODBC Driver 18 for SQL Server",
                 "ODBC Driver 17 for SQL Server",
                 "ODBC Driver 13.1 for SQL Server",
                 "ODBC Driver 13 for SQL Server",
@@ -108,23 +124,23 @@ class SqlServerDatabase(Database):
             errors: list[BaseException] = []
 
             def _try_drivers():
+                attributes: list[tuple[str, object]] = [
+                    ("SERVER", self._server_attribute()),
+                    ("MARS_Connection", "Yes"),
+                    ("DATABASE", self.db_name),
+                ]
+                if self.user:
+                    attributes.append(("Uid", self.user))
+                    if self.password:
+                        attributes.append(("Pwd", self.password))
+                else:
+                    attributes.append(("Trusted_Connection", "yes"))
+                if self.trust_server_certificate:
+                    # Driver 18 encrypts and verifies the server's certificate
+                    # by default; this accepts a self-signed one.
+                    attributes.append(("TrustServerCertificate", "yes"))
                 for drv in ssdrivers:
-                    if self.user:
-                        if self.password:
-                            connstr = (
-                                f"DRIVER={{{drv}}};SERVER={self.server_name};MARS_Connection=Yes; "
-                                f"DATABASE={self.db_name};Uid={self.user};Pwd={self.password}"
-                            )
-                        else:
-                            connstr = (
-                                f"DRIVER={{{drv}}};SERVER={self.server_name};MARS_Connection=Yes; "
-                                f"DATABASE={self.db_name};Uid={self.user}"
-                            )
-                    else:
-                        connstr = (
-                            f"DRIVER={{{drv}}};SERVER={self.server_name};MARS_Connection=Yes; "
-                            f"DATABASE={self.db_name};Trusted_Connection=yes"
-                        )
+                    connstr = connection_string(drv, attributes)
                     try:
                         # 30 s connect timeout matches the Postgres adapter
                         # default; pyodbc treats `timeout` as the login-and-
@@ -134,12 +150,12 @@ class SqlServerDatabase(Database):
                         errors.append(e)
                         if _state.exec_log is not None:
                             _state.exec_log.log_status_info(
-                                f"Could not connect using: {re.sub(r'Pwd=[^;]*', 'Pwd=***', connstr)}",
+                                f"Could not connect using: {loggable(drv, attributes)}",
                             )
                     else:
                         if _state.exec_log is not None:
                             _state.exec_log.log_status_info(
-                                f"Connected using: {re.sub(r'Pwd=[^;]*', 'Pwd=***', connstr)}",
+                                f"Connected using: {loggable(drv, attributes)}",
                             )
                         return True
                 return False