t-sql 0.1.2__tar.gz → 1.0.0__tar.gz

{t_sql-0.1.2 → t_sql-1.0.0}/PKG-INFO

@@ -1,7 +1,8 @@
 Metadata-Version: 2.4
 Name: t-sql
-Version: 0.1.2
+Version: 1.0.0
 Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
+Project-URL: Homepage, https://github.com/nhumrich/tsql
 Requires-Python: >=3.14
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -14,10 +15,27 @@ A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP
 TSQL provides a safe way to write SQL queries using Python's template strings (t-strings) while preventing SQL injection attacks through multiple parameter styling options.
 
 ## ⚠️ Python Version Requirement
-This library requires Python 3.14b1 or newer.
+This library requires Python 3.14+
 
 TSQL is built specifically to take advantage of the new t-string feature introduced in PEP 750, which is only available in Python 3.14+.
 
+## Installing
+
+```
+# with pip
+pip install t-sql
+
+# with uv
+uv add t-sql
+```
+
+## using
+
+```
+import tsql
+
+tsql.render(t"select * from users where name={name)")
+```
 
 ## Parameter Styles
 
@@ -95,7 +113,7 @@ You can use the "unsafe" format spec for these
 cases:
 ```python
 dynamic_where = input('type where clause')
-tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
+tsql.render(t"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 ```
 
 ### as_values
@@ -103,6 +121,11 @@ tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 The spec `:as_values` formats a dictionary into the format:
 `(key1, key2, ...) VALUES (value1, value2, ...)` for uses in insert statements.
 
+### as_set
+
+The spec `:as_set` formats a dictionary into the format:
+`key1='?', key2='?'` for uses in update statements.
+
 ### traditional format_spec
 
 All other format specs should be handled as they would in a normal f-string. 

t_sql-0.1.2/t_sql.egg-info/PKG-INFO → t_sql-1.0.0/README.md

@@ -1,12 +1,3 @@
-Metadata-Version: 2.4
-Name: t-sql
-Version: 0.1.2
-Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
-Requires-Python: >=3.14
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Dynamic: license-file
-
 # tsql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -14,10 +5,27 @@ A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP
 TSQL provides a safe way to write SQL queries using Python's template strings (t-strings) while preventing SQL injection attacks through multiple parameter styling options.
 
 ## ⚠️ Python Version Requirement
-This library requires Python 3.14b1 or newer.
+This library requires Python 3.14+
 
 TSQL is built specifically to take advantage of the new t-string feature introduced in PEP 750, which is only available in Python 3.14+.
 
+## Installing
+
+```
+# with pip
+pip install t-sql
+
+# with uv
+uv add t-sql
+```
+
+## using
+
+```
+import tsql
+
+tsql.render(t"select * from users where name={name)")
+```
 
 ## Parameter Styles
 
@@ -95,7 +103,7 @@ You can use the "unsafe" format spec for these
 cases:
 ```python
 dynamic_where = input('type where clause')
-tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
+tsql.render(t"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 ```
 
 ### as_values
@@ -103,6 +111,11 @@ tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 The spec `:as_values` formats a dictionary into the format:
 `(key1, key2, ...) VALUES (value1, value2, ...)` for uses in insert statements.
 
+### as_set
+
+The spec `:as_set` formats a dictionary into the format:
+`key1='?', key2='?'` for uses in update statements.
+
 ### traditional format_spec
 
 All other format specs should be handled as they would in a normal f-string. 

{t_sql-0.1.2 → t_sql-1.0.0}/pyproject.toml

@@ -1,11 +1,15 @@
 [project]
 name = "t-sql"
-version = "0.1.2"
+version = "1.0.0"
 description = "Safe SQL. SQL queries for python t-strings (PEP 750)"
 readme = "README.md"
 requires-python = ">=3.14"
 dependencies = []
 
+[project.urls]
+Homepage = "https://github.com/nhumrich/tsql"
+
+
 [dependency-groups]
 dev = [
     "anyio>=4.9.0",

t_sql-0.1.2/README.md → t_sql-1.0.0/t_sql.egg-info/PKG-INFO

@@ -1,3 +1,13 @@
+Metadata-Version: 2.4
+Name: t-sql
+Version: 1.0.0
+Summary: Safe SQL. SQL queries for python t-strings (PEP 750)
+Project-URL: Homepage, https://github.com/nhumrich/tsql
+Requires-Python: >=3.14
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
 # tsql
 
 A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP 750).
@@ -5,10 +15,27 @@ A lightweight SQL templating library that leverages Python 3.14's t-strings (PEP
 TSQL provides a safe way to write SQL queries using Python's template strings (t-strings) while preventing SQL injection attacks through multiple parameter styling options.
 
 ## ⚠️ Python Version Requirement
-This library requires Python 3.14b1 or newer.
+This library requires Python 3.14+
 
 TSQL is built specifically to take advantage of the new t-string feature introduced in PEP 750, which is only available in Python 3.14+.
 
+## Installing
+
+```
+# with pip
+pip install t-sql
+
+# with uv
+uv add t-sql
+```
+
+## using
+
+```
+import tsql
+
+tsql.render(t"select * from users where name={name)")
+```
 
 ## Parameter Styles
 
@@ -86,7 +113,7 @@ You can use the "unsafe" format spec for these
 cases:
 ```python
 dynamic_where = input('type where clause')
-tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
+tsql.render(t"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 ```
 
 ### as_values
@@ -94,6 +121,11 @@ tsql.render(f"SELECT * FROM users WHERE {dynamic_where:unsafe}")
 The spec `:as_values` formats a dictionary into the format:
 `(key1, key2, ...) VALUES (value1, value2, ...)` for uses in insert statements.
 
+### as_set
+
+The spec `:as_set` formats a dictionary into the format:
+`key1='?', key2='?'` for uses in update statements.
+
 ### traditional format_spec
 
 All other format specs should be handled as they would in a normal f-string. 
@@ -148,4 +180,4 @@ def execute_sql_query(query):
     
     return sql_engine.execute(*tsql.render(query))
 
-```
+```

{t_sql-0.1.2 → t_sql-1.0.0}/t_sql.egg-info/SOURCES.txt

@@ -8,7 +8,11 @@ t_sql.egg-info/top_level.txt
 tests/test_asyncpg_integration.py
 tests/test_different_object_types.py
 tests/test_escaped.py
+tests/test_escaped_binary_hex.py
 tests/test_helper_functions.py
+tests/test_injection_edge_cases.py
+tests/test_injection_protection_validation.py
+tests/test_injections_for_escaped.py
 tests/test_styles.py
 tests/test_tsql.py
 tsql/__init__.py

{t_sql-0.1.2 → t_sql-1.0.0}/tests/test_asyncpg_integration.py

@@ -6,12 +6,11 @@ import tsql.styles
 
 
 # Test configuration
-DATABASE_URL = "postgresql://postgres:password@localhost:5432/postgres"
+DATABASE_URL = "postgresql://postgres:password@localhost:5454/postgres"
 
 
 @pytest.fixture
 async def conn():
-    """Helper to set up a clean test table and return a connection"""
     conn = await asyncpg.connect(DATABASE_URL)
 
     await conn.execute("""
@@ -32,10 +31,6 @@ async def conn():
 
 
 async def test_escaped_style_with_postgres(conn):
-    """Test ESCAPED style works correctly with PostgreSQL"""
-
-    # Insert data using ESCAPED style
-
     values = dict(
         name = "John O'Connor",
         age = 30,
@@ -55,7 +50,6 @@ async def test_escaped_style_with_postgres(conn):
     assert "TRUE" in query
     assert "75000.5" in query
 
-    # Execute the query
     await conn.execute(query)
 
     # Verify data was inserted correctly
@@ -67,10 +61,6 @@ async def test_escaped_style_with_postgres(conn):
 
 
 async def test_numeric_dollar_style_with_asyncpg(conn):
-    """Test NUMERIC_DOLLAR style works correctly with PostgreSQL"""
-
-    # Insert data using ESCAPED style
-
     values = dict(
         name="John O'Connor",
         age=30,
@@ -88,7 +78,6 @@ async def test_numeric_dollar_style_with_asyncpg(conn):
     assert "$3" in query
     assert "'$4" in query
 
-    # Execute the query
     await conn.execute(query)
 
     # Verify data was inserted correctly
@@ -100,8 +89,6 @@ async def test_numeric_dollar_style_with_asyncpg(conn):
 
 
 async def test_escaped_prevents_sql_injection_in_db(conn):
-    """Test that ESCAPED style prevents SQL injection in real database"""
-
     # Attempt SQL injection
     malicious_name = "'; DROP TABLE test_users; --"
     age = 25
@@ -111,11 +98,9 @@ async def test_escaped_prevents_sql_injection_in_db(conn):
         style=tsql.styles.ESCAPED
     )
 
-    # Verify the malicious input is properly escaped
     assert params == []
     assert "'''; DROP TABLE test_users; --'" in query
 
-    # Execute the query - this should safely insert the malicious string as data
     await conn.execute(query)
 
     # Verify the table still exists and contains the escaped data
@@ -129,8 +114,6 @@ async def test_escaped_prevents_sql_injection_in_db(conn):
 
 
 async def test_numeric_dollar_style_with_asyncpg(conn):
-    """Test NUMERIC_DOLLAR style works natively with asyncpg"""
-
     name = "David Wilson"
     age = 33
 
@@ -143,7 +126,6 @@ async def test_numeric_dollar_style_with_asyncpg(conn):
     assert "$1" in query and "$2" in query
     assert params == ["David Wilson", 33]
 
-    # Execute directly (no conversion needed)
     await conn.execute(query, *params)
 
     # Verify data was inserted correctly
@@ -153,8 +135,6 @@ async def test_numeric_dollar_style_with_asyncpg(conn):
 
 
 async def test_escaped_handles_null_values_in_db(conn):
-    """Test ESCAPED style handles NULL values correctly in database"""
-
     name = None
     age = 30
 
@@ -167,17 +147,14 @@ async def test_escaped_handles_null_values_in_db(conn):
     assert "NULL" in query
     assert "30" in query
 
-    # Execute the query
     await conn.execute(query)
 
-    # Verify NULL was inserted correctly
     row = await conn.fetchrow("SELECT * FROM test_users WHERE age = $1", 30)
     assert row['name'] is None
     assert row['age'] == 30
 
 
 async def test_escaped_complex_query_with_db(conn):
-    """Test ESCAPED style with complex query involving multiple conditions"""
     # Insert some test data first
     await conn.execute("""
         INSERT INTO test_users (name, age, active, salary) VALUES 
@@ -201,7 +178,6 @@ async def test_escaped_complex_query_with_db(conn):
     assert "'O''Brien'" in query  # Single quote should be escaped
     assert "TRUE" in query
 
-    # Execute the query
     rows = await conn.fetch(query)
 
     # Should find Charlie O'Brien
@@ -212,21 +188,16 @@ async def test_escaped_complex_query_with_db(conn):
 
 
 async def test_compare_escaped_vs_parameterized(conn):
-    """Compare ESCAPED vs parameterized query results"""
-
-    # Test data
     name = "Test User"
     age = 25
     active = True
 
-    # Insert using ESCAPED style
     query1, params1 = tsql.render(
         t"INSERT INTO test_users (name, age, active) VALUES ({name}, {age}, {active})",
         style=tsql.styles.ESCAPED
     )
     await conn.execute(query1)
 
-    # Insert using NUMERIC_DOLLAR style
     query2, params2 = tsql.render(
         t"INSERT INTO test_users (name, age, active) VALUES ({name}, {age}, {active})",
         style=tsql.styles.NUMERIC_DOLLAR
@@ -245,16 +216,13 @@ async def test_compare_escaped_vs_parameterized(conn):
 
 
 async def test_escaped_handles_union_attack(conn):
-    """Test prevention of UNION-based injection"""
-    # malicious_input = "' UNION SELECT password FROM test_users WHERE '1'='1"
-    malicious_input = "11"
+    malicious_input = "' UNION SELECT password FROM test_users WHERE '1'='1"
     query, _ = tsql.render(t"SELECT * FROM test_users WHERE name = {malicious_input}", style=tsql.styles.ESCAPED)
     rows = await conn.fetch(query)
     assert len(rows) == 0
 
 
 async def test_escaped_handles_boolean_injection(conn):
-    """Test prevention of boolean-based injection"""
     malicious_input = "' OR '1'='1"
     query, _ = tsql.render(t"SELECT * FROM test_users WHERE name = {malicious_input}", style=tsql.styles.ESCAPED)
     rows = await conn.fetch(query)
@@ -262,7 +230,6 @@ async def test_escaped_handles_boolean_injection(conn):
 
 
 async def test_escaped_handles_comment_injection(conn):
-    """Test prevention of comment-based injection"""
     malicious_input = "admin'--"
     query, _ = tsql.render(t"SELECT * FROM test_users WHERE name = {malicious_input}", style=tsql.styles.ESCAPED)
     rows = await conn.fetch(query)

t_sql-1.0.0/tests/test_escaped_binary_hex.py

@@ -0,0 +1,146 @@
+"""
+Test the hybrid ESCAPED style behavior with binary data
+"""
+import tsql
+import tsql.styles
+
+
+def test_escaped_hex_with_mixed_types():
+    """Test that ESCAPED style handles mixed data types correctly"""
+
+    # Mix of different data types including binary
+    filename = "test.bin"
+    size = 1024
+    active = True
+    binary_data = b"'; DROP TABLE files; --"
+
+    result = tsql.render(
+        t"INSERT INTO files (name, size, active, data) VALUES ({filename}, {size}, {active}, {binary_data})",
+        style=tsql.styles.ESCAPED
+    )
+
+    # Should escape strings, numbers, bools and convert binary to hex literal
+    expected_hex = binary_data.hex()
+    expected_query = f"INSERT INTO files (name, size, active, data) VALUES ('test.bin', 1024, TRUE, '\\x{expected_hex}')"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped
+
+
+def test_escaped_hex_multiple_binary_values():
+    """Test ESCAPED style with multiple binary values"""
+
+    binary1 = b"first'; DROP TABLE test; --"
+    binary2 = b"second'; DELETE FROM users; --"
+    name = "test"
+
+    result = tsql.render(
+        t"INSERT INTO files (name, data1, data2) VALUES ({name}, {binary1}, {binary2})",
+        style=tsql.styles.ESCAPED
+    )
+
+    # Should convert both binary values to hex literals
+    hex1 = binary1.hex()
+    hex2 = binary2.hex()
+    expected_query = f"INSERT INTO files (name, data1, data2) VALUES ('test', '\\x{hex1}', '\\x{hex2}')"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped
+
+
+def test_escaped_hex_binary_with_quotes():
+    """Test that binary data with quotes is safely converted to hex"""
+
+    # Binary data containing various injection attempts
+    malicious_binary = b"'; DELETE FROM users WHERE '1'='1'; --"
+    safe_string = "normal string"
+
+    result = tsql.render(
+        t"UPDATE files SET name = {safe_string}, data = {malicious_binary} WHERE id = 1",
+        style=tsql.styles.ESCAPED
+    )
+
+    expected_hex = malicious_binary.hex()
+    expected_query = f"UPDATE files SET name = 'normal string', data = '\\x{expected_hex}' WHERE id = 1"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped
+
+
+def test_escaped_all_string_no_hybrid():
+    """Test that pure string queries remain fully escaped (no parameters)"""
+
+    name = "file.txt"
+    content = "some content"
+
+    result = tsql.render(
+        t"INSERT INTO files (name, content) VALUES ({name}, {content})",
+        style=tsql.styles.ESCAPED
+    )
+
+    # Should be fully escaped with no parameters
+    expected_query = "INSERT INTO files (name, content) VALUES ('file.txt', 'some content')"
+    assert result[0] == expected_query
+    assert result[1] == []
+
+
+def test_escaped_string_injection_still_escaped():
+    """Test that string injection attempts are still properly escaped"""
+
+    malicious_string = "'; DROP TABLE users; --"
+
+    result = tsql.render(
+        t"SELECT * FROM users WHERE name = {malicious_string}",
+        style=tsql.styles.ESCAPED
+    )
+
+    # String should be escaped, no parameters
+    expected_query = "SELECT * FROM users WHERE name = '''; DROP TABLE users; --'"
+    assert result[0] == expected_query
+    assert result[1] == []
+
+
+def test_escaped_binary_only_hex():
+    """Test ESCAPED style with only binary data (pure hex literal)"""
+
+    binary_data = b"binary content with '; injection"
+
+    result = tsql.render(
+        t"INSERT INTO files (data) VALUES ({binary_data})",
+        style=tsql.styles.ESCAPED
+    )
+
+    # Should be fully escaped as hex literal
+    expected_hex = binary_data.hex()
+    expected_query = f"INSERT INTO files (data) VALUES ('\\x{expected_hex}')"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped
+
+
+def test_escaped_empty_binary_data():
+    """Test ESCAPED style with empty binary data"""
+
+    empty_binary = b""
+    name = "empty.bin"
+
+    result = tsql.render(
+        t"INSERT INTO files (name, data) VALUES ({name}, {empty_binary})",
+        style=tsql.styles.ESCAPED
+    )
+
+    expected_query = "INSERT INTO files (name, data) VALUES ('empty.bin', '\\x')"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped
+
+
+def test_escaped_binary_with_null_bytes():
+    """Test ESCAPED style with binary data containing null bytes"""
+
+    binary_with_nulls = b"data\x00with\x00nulls\x00'; DROP TABLE test; --"
+
+    result = tsql.render(
+        t"INSERT INTO files (data) VALUES ({binary_with_nulls})",
+        style=tsql.styles.ESCAPED
+    )
+
+    expected_hex = binary_with_nulls.hex()
+    expected_query = f"INSERT INTO files (data) VALUES ('\\x{expected_hex}')"
+    assert result[0] == expected_query
+    assert result[1] == []  # No parameters - fully escaped

{t_sql-0.1.2 → t_sql-1.0.0}/tests/test_helper_functions.py

@@ -21,7 +21,7 @@ def test_as_values():
         'age': 30
     }
     result = tsql.render(t"INSERT INTO users {values:as_values}")
-    
+
     # Should generate INSERT INTO users (name, age) VALUES (?, ?)
     assert "INSERT INTO users" in result[0]
     assert "name" in result[0] and "age" in result[0]
@@ -29,6 +29,22 @@ def test_as_values():
     assert result[1] == ['John', 30]
 
 
+def test_as_set():
+    """Test the as_set format specifier"""
+    values = {
+        'name': 'John Updated',
+        'age': 35
+    }
+    result = tsql.render(t"UPDATE users SET {values:as_set} WHERE id = {123}")
+
+    # Should generate UPDATE users SET name = ?, age = ? WHERE id = ?
+    assert "UPDATE users SET" in result[0]
+    assert "name = ?" in result[0]
+    assert "age = ?" in result[0]
+    assert "WHERE id = ?" in result[0]
+    assert result[1] == ['John Updated', 35, 123]
+
+
 def test_insert():
     """Test the insert helper function"""
     values = {

t_sql-1.0.0/tests/test_injection_edge_cases.py

@@ -0,0 +1,161 @@
+import pytest
+import tsql
+import tsql.styles
+
+
+def test_literal_injection_prevention():
+    malicious_table = "users; DROP TABLE secrets; --"
+
+    with pytest.raises(ValueError):
+        tsql.render(t"SELECT * FROM {malicious_table:literal}")
+
+
+def test_literal_with_quotes_prevention():
+    malicious_column = "name'; DROP TABLE users; --"
+
+    with pytest.raises(ValueError):
+        tsql.render(t"SELECT {malicious_column:literal} FROM users")
+
+
+def test_binary_data_injection():
+    """Test handling of binary data that might contain SQL"""
+    # Binary data that contains SQL-like bytes
+    malicious_binary = b"'; DROP TABLE users; --"
+
+    # Test parameterized style (default)
+    result = tsql.render(t"INSERT INTO files (data) VALUES ({malicious_binary})")
+    assert result[0] == "INSERT INTO files (data) VALUES (?)"
+    # Binary data should be passed through as bytes, not converted to string
+    assert result[1] == [malicious_binary]
+    assert isinstance(result[1][0], bytes)
+
+    # Test ESCAPED style - should convert to safe hex literal (no parameters)
+    result_escaped = tsql.render(
+        t"INSERT INTO files (data) VALUES ({malicious_binary})",
+        style=tsql.styles.ESCAPED
+    )
+    expected_hex = malicious_binary.hex()
+    assert result_escaped[0] == f"INSERT INTO files (data) VALUES ('\\x{expected_hex}')"
+    assert result_escaped[1] == []
+
+
+def test_cross_parameter_injection():
+    """Test prevention of injection across multiple parameters"""
+    param1 = "'; --"
+    param2 = "OR 1=1"
+
+    # Test parameterized style (default)
+    result = tsql.render(t"SELECT * FROM users WHERE name = {param1} AND role = {param2}")
+    assert result[0] == "SELECT * FROM users WHERE name = ? AND role = ?"
+    assert result[1] == [param1, param2]
+
+    # Test ESCAPED style
+    result_escaped = tsql.render(t"SELECT * FROM users WHERE name = {param1} AND role = {param2}", style=tsql.styles.ESCAPED)
+    expected_param1 = param1.replace("'", "''")
+    expected_param2 = param2.replace("'", "''")
+    assert result_escaped[0] == f"SELECT * FROM users WHERE name = '{expected_param1}' AND role = '{expected_param2}'"
+    assert result_escaped[1] == []
+
+
+def test_nested_template_injection():
+    """Test injection prevention in nested templates"""
+    malicious_value = "'; DROP TABLE users; --"
+    inner_template = t"WHERE id = {malicious_value}"
+
+    # Test parameterized style (default)
+    result = tsql.render(t"SELECT * FROM users {inner_template}")
+    assert result[0] == "SELECT * FROM users WHERE id = ?"
+    assert result[1] == [malicious_value]
+
+    # Test ESCAPED style
+    result_escaped = tsql.render(t"SELECT * FROM users {inner_template}", style=tsql.styles.ESCAPED)
+    expected_escaped = malicious_value.replace("'", "''")
+    assert result_escaped[0] == f"SELECT * FROM users WHERE id = '{expected_escaped}'"
+    assert result_escaped[1] == []
+
+
+def test_helper_function_injection():
+    """Test injection prevention in helper functions"""
+    malicious_table = "users; DROP TABLE secrets; --"
+    malicious_id = "1; DELETE FROM users; --"
+
+    # This should raise ValueError for malicious table name
+    with pytest.raises(ValueError):
+        tsql.select(malicious_table, malicious_id)
+
+
+def test_large_payload_injection():
+    """Test handling of very large malicious payloads"""
+    large_payload = "'; " + "DROP TABLE users; " * 1000 + "--"
+
+    # Test parameterized style (default)
+    result = tsql.render(t"SELECT * FROM users WHERE name = {large_payload}")
+    assert result[0] == "SELECT * FROM users WHERE name = ?"
+    assert result[1] == [large_payload]
+
+    # Test ESCAPED style
+    result_escaped = tsql.render(t"SELECT * FROM users WHERE name = {large_payload}", style=tsql.styles.ESCAPED)
+    expected_escaped = large_payload.replace("'", "''")
+    assert result_escaped[0] == f"SELECT * FROM users WHERE name = '{expected_escaped}'"
+    assert result_escaped[1] == []
+
+
+def test_encoding_bypass_attempts():
+    """Test prevention of encoding-based bypass attempts"""
+    encoding_attacks = [
+        "'; DROP TABLE users; --",  # Normal
+        "\'; DROP TABLE users; --",  # Backslash escaped
+        "\\'; DROP TABLE users; --",  # Double backslash
+        "%27; DROP TABLE users; --",  # URL encoded single quote
+        "' DROP TABLE users; --"  # HTML entity
+    ]
+
+    for attack in encoding_attacks:
+        # Test parameterized style (default)
+        result = tsql.render(t"SELECT * FROM users WHERE name = {attack}")
+        assert result[0] == "SELECT * FROM users WHERE name = ?"
+        assert result[1] == [attack]
+
+        # Test ESCAPED style
+        result_escaped = tsql.render(t"SELECT * FROM users WHERE name = {attack}", style=tsql.styles.ESCAPED)
+        expected_escaped = attack.replace("'", "''")
+        assert result_escaped[0] == f"SELECT * FROM users WHERE name = '{expected_escaped}'"
+        assert result_escaped[1] == []
+
+
+def test_database_specific_functions():
+    """Test prevention of database-specific function injection"""
+    db_specific_attacks = [
+        "'; SELECT sqlite_version(); --",  # SQLite
+        "'; SELECT @@version; --",  # SQL Server/MySQL
+        "'; SELECT version(); --",  # PostgreSQL
+        "'; SELECT banner FROM v$version; --",  # Oracle
+    ]
+
+    for attack in db_specific_attacks:
+        # Test parameterized style (default)
+        result = tsql.render(t"SELECT * FROM users WHERE id = {attack}")
+        assert result[0] == "SELECT * FROM users WHERE id = ?"
+        assert result[1] == [attack]
+
+        # Test ESCAPED style
+        result_escaped = tsql.render(t"SELECT * FROM users WHERE id = {attack}", style=tsql.styles.ESCAPED)
+        expected_escaped = attack.replace("'", "''")
+        assert result_escaped[0] == f"SELECT * FROM users WHERE id = '{expected_escaped}'"
+        assert result_escaped[1] == []
+
+
+def test_unsafe_parameter_injection():
+    """Test that :unsafe parameters are properly handled (if implemented)"""
+    # Note: This assumes :unsafe is implemented - remove if not
+    malicious_value = "'; DROP TABLE users; --"
+
+    # :unsafe should allow the value through without parameterization
+    # but this is intentionally dangerous and should be used carefully
+    result = tsql.render(t"SELECT * FROM users WHERE debug = {malicious_value:unsafe}")
+    # This will depend on your :unsafe implementation
+    assert "DROP TABLE users" in result[0]  # Should be directly embedded
+
+    # Test ESCAPED style with :unsafe (should behave the same)
+    result_escaped = tsql.render(t"SELECT * FROM users WHERE debug = {malicious_value:unsafe}", style=tsql.styles.ESCAPED)
+    assert "DROP TABLE users" in result_escaped[0]  # Should be directly embedded

t_sql-1.0.0/tests/test_injection_protection_validation.py

@@ -0,0 +1,237 @@
+import asyncpg
+import pytest
+
+import tsql
+import tsql.styles
+
+# Test configuration
+DATABASE_URL = "postgresql://postgres:password@localhost:5454/postgres"
+
+
+@pytest.fixture
+async def conn():
+    """Helper to set up a clean test table and return a connection"""
+    conn = await asyncpg.connect(DATABASE_URL)
+
+    # Create a test table with sensitive data
+    await conn.execute("""
+        CREATE TABLE IF NOT EXISTS test_users (
+            id SERIAL PRIMARY KEY,
+            name VARCHAR(100),
+            password VARCHAR(100),
+            role VARCHAR(50),
+            salary DECIMAL(10,2),
+            active BOOLEAN DEFAULT TRUE
+        )
+    """)
+
+    # Create a sensitive admin table
+    await conn.execute("""
+        CREATE TABLE IF NOT EXISTS admin_secrets (
+            id SERIAL PRIMARY KEY,
+            secret_key VARCHAR(255),
+            admin_password VARCHAR(100)
+        )
+    """)
+
+    # Clean up existing data
+    await conn.execute("DELETE FROM test_users")
+    await conn.execute("DELETE FROM admin_secrets")
+
+    # Insert some test data
+    await conn.execute("""
+        INSERT INTO test_users (name, password, role, salary) VALUES
+        ('alice', 'secret123', 'user', 50000),
+        ('bob', 'password456', 'user', 60000),
+        ('admin', 'supersecret', 'admin', 100000)
+    """)
+
+    await conn.execute("""
+        INSERT INTO admin_secrets (secret_key, admin_password) VALUES
+        ('TOP_SECRET_KEY_123', 'admin_master_password')
+    """)
+
+    yield conn
+
+    await conn.execute("DROP TABLE IF EXISTS test_users")
+    await conn.execute("DROP TABLE IF EXISTS admin_secrets")
+    await conn.close()
+
+
+async def test_parameterized_injection_protection(conn):
+    """Verify parameterized queries properly protect against injection"""
+
+    # Classic injection attempts
+    injection_attempts = [
+        "' OR 1=1 --",
+        "'; DROP TABLE test_users; --",
+        "' UNION SELECT secret_key, admin_password, 'hacker', 0, true FROM admin_secrets --",
+        "admin'--"
+    ]
+
+    for malicious_input in injection_attempts:
+        query, params = tsql.render(
+            t"SELECT * FROM test_users WHERE name = {malicious_input}",
+            style=tsql.styles.NUMERIC_DOLLAR  # Use asyncpg-compatible style
+        )
+
+        # Should be parameterized with $1 style
+        assert "$1" in query
+        assert params == [malicious_input]
+
+        # Execute the parameterized query - should safely find no matching users
+        rows = await conn.fetch(query, *params)
+        assert len(rows) == 0
+
+        # Verify database integrity - original data should be intact
+        user_count = await conn.fetchval("SELECT COUNT(*) FROM test_users")
+        admin_count = await conn.fetchval("SELECT COUNT(*) FROM admin_secrets")
+        assert user_count == 3  # Original test users
+        assert admin_count == 1  # Original admin secret
+
+
+async def test_escaped_injection_protection(conn):
+    """Verify ESCAPED style properly protects against injection"""
+
+    injection_attempts = [
+        "' OR 1=1 --",
+        "'; DROP TABLE test_users; --",
+        "' UNION SELECT secret_key FROM admin_secrets --",
+        "admin'--"
+    ]
+
+    for malicious_input in injection_attempts:
+        query, params = tsql.render(
+            t"SELECT * FROM test_users WHERE name = {malicious_input}",
+            style=tsql.styles.ESCAPED
+        )
+
+        # Should be escaped (no parameters)
+        assert params == []
+        escaped_input = malicious_input.replace("'", "''")
+        assert f"'{escaped_input}'" in query
+
+        # Execute the escaped query - should safely find no matching users
+        rows = await conn.fetch(query)
+        assert len(rows) == 0
+
+        # Verify database integrity
+        user_count = await conn.fetchval("SELECT COUNT(*) FROM test_users")
+        admin_count = await conn.fetchval("SELECT COUNT(*) FROM admin_secrets")
+        assert user_count == 3
+        assert admin_count == 1
+
+
+async def test_injection_treated_as_literal_data(conn):
+    """Verify injection attempts are treated as literal data, not SQL code"""
+
+    # Insert the malicious input as literal data
+    malicious_name = "'; DROP TABLE test_users; --"
+
+    # First, insert this as actual data using parameterized query
+    insert_query, insert_params = tsql.render(
+        t"INSERT INTO test_users (name, role) VALUES ({malicious_name}, 'test')",
+        style=tsql.styles.NUMERIC_DOLLAR
+    )
+    await conn.execute(insert_query, *insert_params)
+
+    # Now search for it using both styles
+    for style in [tsql.styles.NUMERIC_DOLLAR, tsql.styles.ESCAPED]:
+        query, params = tsql.render(
+            t"SELECT * FROM test_users WHERE name = {malicious_name}",
+            style=style
+        )
+
+        rows = await conn.fetch(query, *params if params else [])
+
+        # Should find exactly 1 row with the malicious string as literal data
+        assert len(rows) == 1
+        assert rows[0]['name'] == malicious_name
+        assert rows[0]['role'] == 'test'
+
+    # Verify the table wasn't dropped by the "injection"
+    user_count = await conn.fetchval("SELECT COUNT(*) FROM test_users")
+    assert user_count == 4  # 3 original + 1 with malicious name
+
+
+async def test_boolean_bypass_prevention(conn):
+    """Verify OR 1=1 type attacks don't bypass authentication"""
+
+    # Simulate authentication bypass attempt
+    username = "nonexistent"
+    malicious_password = "' OR 1=1 --"
+
+    for style in [tsql.styles.NUMERIC_DOLLAR, tsql.styles.ESCAPED]:
+        query, params = tsql.render(
+            t"SELECT * FROM test_users WHERE name = {username} AND password = {malicious_password}",
+            style=style
+        )
+
+        rows = await conn.fetch(query, *params if params else [])
+
+        # Should return 0 rows - authentication should fail
+        assert len(rows) == 0
+
+
+async def test_admin_escalation_prevention(conn):
+    """Verify injection can't escalate privileges to admin"""
+
+    malicious_inputs = [
+        "' OR role = 'admin' --",
+        "' UNION SELECT * FROM test_users WHERE role = 'admin' --",
+        "anything' OR 1=1 --"
+    ]
+
+    for malicious_input in malicious_inputs:
+        for style in [tsql.styles.NUMERIC_DOLLAR, tsql.styles.ESCAPED]:
+            query, params = tsql.render(
+                t"SELECT * FROM test_users WHERE name = {malicious_input} AND role = 'user'",
+                style=style
+            )
+
+            rows = await conn.fetch(query, *params if params else [])
+
+            # Should not return admin users
+            for row in rows:
+                assert row.get('role') != 'admin'
+                assert row.get('name') != 'admin'
+
+
+async def test_literal_parameter_protection(conn):
+    """Verify :literal parameters reject malicious table/column names"""
+
+    malicious_table_names = [
+        "test_users; DROP TABLE admin_secrets; --",
+        "test_users UNION SELECT * FROM admin_secrets --",
+        "test_users' OR 1=1 --"
+    ]
+
+    for malicious_table in malicious_table_names:
+        # Should raise ValueError before reaching database
+        with pytest.raises(ValueError):
+            tsql.render(t"SELECT * FROM {malicious_table:literal}")
+
+
+async def test_stacked_query_prevention(conn):
+    """Verify stacked queries can't execute additional commands"""
+
+    malicious_input = "'; INSERT INTO test_users (name, role) VALUES ('hacker', 'admin'); --"
+
+    original_count = await conn.fetchval("SELECT COUNT(*) FROM test_users")
+
+    for style in [tsql.styles.NUMERIC_DOLLAR, tsql.styles.ESCAPED]:
+        query, params = tsql.render(
+            t"SELECT * FROM test_users WHERE name = {malicious_input}",
+            style=style
+        )
+
+        rows = await conn.fetch(query, *params if params else [])
+        assert len(rows) == 0
+
+    # Verify no hacker user was inserted
+    final_count = await conn.fetchval("SELECT COUNT(*) FROM test_users")
+    assert final_count == original_count
+
+    # Explicitly check no hacker exists
+    hacker_count = await conn.fetchval("SELECT COUNT(*) FROM test_users WHERE name = 'hacker'")
+    assert hacker_count == 0

t_sql-1.0.0/tests/test_injections_for_escaped.py

@@ -0,0 +1,163 @@
+"""
+Proof-of-concept test demonstrating that tsql actually prevents SQL injection attacks
+against a real PostgreSQL database.
+"""
+import asyncpg
+import pytest
+
+import tsql
+import tsql.styles
+
+DATABASE_URL = "postgresql://postgres:password@localhost:5454/postgres"
+
+
+@pytest.fixture
+async def conn():
+    """Set up test database with sensitive data"""
+    conn = await asyncpg.connect(DATABASE_URL)
+
+    await conn.execute("""
+        CREATE TABLE IF NOT EXISTS users (
+            id SERIAL PRIMARY KEY,
+            username VARCHAR(50),
+            password VARCHAR(100),
+            is_admin BOOLEAN DEFAULT FALSE
+        )
+    """)
+
+    await conn.execute("""
+        CREATE TABLE IF NOT EXISTS secrets (
+            id SERIAL PRIMARY KEY,
+            secret_data VARCHAR(255)
+        )
+    """)
+
+    # Clean up previous data if exsist
+    await conn.execute("DELETE FROM users")
+    await conn.execute("DELETE FROM secrets")
+
+    # Insert test data
+    await conn.execute("""
+        INSERT INTO users (username, password, is_admin) VALUES
+        ('alice', 'password123', false),
+        ('admin', 'supersecret', true)
+    """)
+
+    await conn.execute("""
+        INSERT INTO secrets (secret_data) VALUES
+        ('TOP_SECRET_ADMIN_KEY')
+    """)
+
+    yield conn
+
+    # Cleanup
+    await conn.execute("DROP TABLE IF EXISTS users")
+    await conn.execute("DROP TABLE IF EXISTS secrets")
+    await conn.close()
+
+
+async def test_basic_injection_attack_with_real_database(conn):
+    malicious_username = "' OR 1=1 --"
+    fake_password = "anything"
+
+    query, params = tsql.render(
+        t"SELECT * FROM users WHERE username = {malicious_username} AND password = {fake_password}",
+        style=tsql.styles.ESCAPED
+    )
+
+    rows = await conn.fetch(query)
+
+    assert len(rows) == 0
+
+async def test_union_injection_attack_with_real_database(conn):
+    malicious_username = "' UNION SELECT id, secret_data, 'fake', true FROM secrets --"
+    query, params = tsql.render(
+        t"SELECT * FROM users WHERE username = {malicious_username}",
+        style=tsql.styles.ESCAPED
+    )
+
+    rows = await conn.fetch(query)
+
+    assert len(rows) == 0
+
+async def test_stacked_injection_attack_with_real_database(conn):
+    malicious_username = "'; DROP TABLE secrets; --"
+
+    query, params = tsql.render(
+        t"SELECT * FROM users WHERE username = {malicious_username}",
+        style=tsql.styles.ESCAPED
+    )
+
+    rows = await conn.fetch(query)
+    assert len(rows) == 0
+
+    secret_count = await conn.fetchval("SELECT COUNT(*) FROM secrets")
+    assert secret_count == 1
+
+
+async def test_legitimate_usage_still_works(conn):
+    username = "alice"
+
+    query, params = tsql.render(
+        t"SELECT * FROM users WHERE username = {username}",
+        style=tsql.styles.ESCAPED
+    )
+
+    rows = await conn.fetch(query)
+
+    assert len(rows) == 1
+    assert rows[0]['username'] == 'alice'
+    assert rows[0]['is_admin'] is False
+
+
+async def test_malicious_data_stored_safely(conn):
+    """Verify malicious strings can be safely stored and retrieved as data"""
+
+    # Store what looks like SQL injection as actual data
+    malicious_data = "'; DROP TABLE users; --"
+
+    # Insert it safely
+    query, params = tsql.render(
+        t"INSERT INTO users (username, password, is_admin) VALUES ({malicious_data}, 'test123', false)",
+        style=tsql.styles.ESCAPED
+    )
+
+    await conn.execute(query)
+
+    # Retrieve it safely
+    query, params = tsql.render(
+        t"SELECT * FROM users WHERE username = {malicious_data}",
+        style=tsql.styles.ESCAPED
+    )
+
+    rows = await conn.fetch(query)
+
+    assert len(rows) == 1
+    assert rows[0]['username'] == malicious_data
+
+    # Verify the database wasn't compromised
+    user_count = await conn.fetchval("SELECT COUNT(*) FROM users")
+    assert user_count == 3  # alice + admin + our malicious_data user
+
+
+
+async def test_error_based_injection_patterns():
+    error_attacks = [
+        "' AND (SELECT TOP 1 name FROM sysobjects WHERE xtype='U') > 0 --",
+        "' AND EXTRACTVALUE(1, CONCAT(0x7e, (SELECT version()), 0x7e)) --",
+        "' AND (SELECT * FROM (SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a) --"
+    ]
+
+    for attack in error_attacks:
+        # Test parameterized style (default)
+        query, params = tsql.render(t"SELECT * FROM users WHERE id = {attack}", s)
+
+        rows = await conn.fetch(query)
+        assert result[0] == "SELECT * FROM users WHERE id = ?"
+        assert result[1] == [attack]
+
+        # Test ESCAPED style
+        result_escaped = tsql.render(t"SELECT * FROM users WHERE id = {attack}", style=tsql.styles.ESCAPED)
+        expected_escaped = attack.replace("'", "''")
+        assert result_escaped[0] == f"SELECT * FROM users WHERE id = '{expected_escaped}'"
+        assert result_escaped[1] == []

{t_sql-0.1.2 → t_sql-1.0.0}/tsql/__init__.py

@@ -44,7 +44,6 @@ class TSQL:
         self._sql_parts = self._sqlize(template_string)
 
     def render(self, style:ParamStyle = None) -> RenderedQuery:
-        print(self._sql_parts)
         if style is None:
             style = default_style
         result = ''
@@ -86,7 +85,6 @@ class TSQL:
             if val.conversion:
                 value = formatter.convert_field(value, val.conversion)
 
-            print('i', val.format_spec, value, type(value))
             match val.format_spec, value:
                 case 'literal', str():
                     cls._check_literal(value)
@@ -95,6 +93,8 @@ class TSQL:
                     return [value]
                 case 'as_values', dict():
                     return as_values(value)._sql_parts
+                case 'as_set', dict():
+                    return as_set(value)._sql_parts
                 case '', TSQL():
                     return val.value._sql_parts
                 case "", Template():
@@ -113,6 +113,8 @@ class TSQL:
                     return inner
                 case _, str():
                     return [Parameter(val.expression, formatter.format_field(value, val.format_spec))]
+                case _, bytes():
+                    return [Parameter(val.expression, value)]
                 case _, int():
                     return [Parameter(val.value, val.value)]
 
@@ -120,7 +122,6 @@ class TSQL:
             return [Parameter(val.expression, formatter.format_field(value, val.format_spec))]
 
         if isinstance(val, Template):
-            print('t', val)
             result = []
             for item in val:
                 if isinstance(item, Interpolation):
@@ -147,7 +148,7 @@ def as_values(value_dict: dict[str, Any]):
     """Convert a dictionary to SQL column list and VALUES clause"""
     keys = list(value_dict.keys())
     values = list(value_dict.values())
-    
+
     # Build column list: (col1, col2, col3)
     column_parts = ['(']
     for i, key in enumerate(keys):
@@ -155,7 +156,7 @@ def as_values(value_dict: dict[str, Any]):
             column_parts.append(', ')
         column_parts.append(key)
     column_parts.append(')')
-    
+
     # Build values list: (?, ?, ?)
     value_parts = [' VALUES (']
     for i, value in enumerate(values):
@@ -163,13 +164,33 @@ def as_values(value_dict: dict[str, Any]):
             value_parts.append(', ')
         value_parts.append(Parameter(f'value_{i}', value))
     value_parts.append(')')
-    
+
     # Create TSQL object manually
     tsql_obj = TSQL.__new__(TSQL)
     tsql_obj._sql_parts = column_parts + value_parts
     return tsql_obj
 
 
+def as_set(value_dict: dict[str, Any]):
+    """Convert a dictionary to SQL SET clause for UPDATE statements"""
+    keys = list(value_dict.keys())
+    values = list(value_dict.values())
+
+    # Build SET clause: col1 = ?, col2 = ?, col3 = ?
+    set_parts = []
+    for i, (key, value) in enumerate(zip(keys, values)):
+        if i > 0:
+            set_parts.append(', ')
+        set_parts.append(key)
+        set_parts.append(' = ')
+        set_parts.append(Parameter(f'value_{i}', value))
+
+    # Create TSQL object manually
+    tsql_obj = TSQL.__new__(TSQL)
+    tsql_obj._sql_parts = set_parts
+    return tsql_obj
+
+
 def render(query: Template|TSQL, style=None) -> RenderedQuery:
     if not isinstance(query, TSQL):
         query = TSQL(query)
@@ -219,5 +240,5 @@ def update(table: str, values: dict[str, Any], id: str):
     if not isinstance(values, dict):
         raise ValueError("values must be a dictionary")
     
-    return TSQL(t"UPDATE {table:literal} SET {values:as_values} WHERE id = {id} RETURNING *")
+    return TSQL(t"UPDATE {table:literal} SET {values:as_set} WHERE id = {id} RETURNING *")
 

{t_sql-0.1.2 → t_sql-1.0.0}/tsql/styles.py

@@ -85,6 +85,10 @@ class ESCAPED(ParamStyle):
                 return "TRUE" if value else "FALSE"
             case int() | float():
                 return str(value)
+            case bytes():
+                # Convert binary data to hex literal - safe from injection since hex only contains [0-9A-F]
+                hex_data = value.hex()
+                return f"'\\x{hex_data}'"
             case _:
                 # For other types, convert to string and escape
                 return f"'{str(value).replace("'", "''")}'"