Feature Request: escape identities

[frafra]

Having a function to escape identities allows creating more dynamic queries while reducing the risk of SQL Injection. psycopg has that: https://www.psycopg.org/psycopg3/docs/api/sql.html#psycopg.sql.Identifier.

Would it be enough to expose SQLIdentifier?

Workaround:

def identity_expression(value):
    return str(FunctionExpression("", ConstantExpression(value).alias("")))[1:-1]

[evertlammerts]

Thanks for the suggestion. duckdb 2.0.0 has this: str(duckdb.col(name)) is always a double quoted identifier with any embedded quote doubled, and duckdb.col('main', 't') gives "main"."t". I checked it against a name like x" from t; drop table t; select, which stays one identifier and fails as column not found. Note that the FunctionExpression('') workaround from your post raises ValueError on 2.0.0, so col() is the way to go. Closing this as implemented in 2.0.0.