#25705: Parameters are not adapted or quoted in Query.__str__
-------------------------------------+-------------------------------------
     Reporter:  Dmitry Dygalo        |                    Owner:  Dmitry
         Type:                       |  Dygalo
  Cleanup/optimization               |                   Status:  assigned
    Component:  Database layer       |                  Version:  master
  (models, ORM)                      |
     Severity:  Normal               |               Resolution:
     Keywords:                       |             Triage Stage:  Accepted
    Has patch:  1                    |      Needs documentation:  0
  Needs tests:  1                    |  Patch needs improvement:  1
Easy pickings:  0                    |                    UI/UX:  0
-------------------------------------+-------------------------------------

Comment (by Bernd Wechner):

 Replying to [ticket:25705 Dmitry Dygalo]:
 > Now it is just string interpolation of the SQL template with parameters
 and in most cases produces invalid queries for the following reasons:
 >
 > - No quoting
 > - No adaptation. So, some python objects will be used as is, not like
 their SQL equivalents
 >
 > Yes, there are situations, when output of `Query.__str__` is equal to
 actual query. But for debugging reasons, it will be better to see real
 query here. Also it is logical and expected behavior of this method - to
 show actual query.

 Fascinating. I inadvertantly filed a duplicate of this it seems:

 https://code.djangoproject.com/ticket/30132#ticket

 and I would dearly love this fixed. In essence  `Query.__str__` should
 return exactly what is logged as per here:

 https://docs.djangoproject.com/en/2.1/faq/models/#how-can-i-see-the-raw-
 sql-queries-django-is-running

 so we can reliably see and extract teh SQL of a query in a production
 environment in which DEBUG is not enabled!

 I would gladly fix this and PR it, if I had the skills and I am close to
 that, as I am coding and debugging python, but single stepping into
 `Query.__str__` didn't find me a quick easy answer and I bailed for now.
 So if you have any tips as to where the code is that `Query.__str__`  uses
 to generate SQL and where the code is that logs SQL to
 `connection.queries`  I canbegin to look at it consider how this might be
 fixed.

 It seems to me an experience Django coder could fix this in minutes and
 that there should be a regression test for this kind of code:

 {{{
 qs=model.objects.somequeryset
 sql=str(qs.query)
 raw_qs=model.objects.raw(sql)
 }}}

 I have a test bed in which I confirmed this failure here:

 ​https://github.com/bernd-
 
wechner/DjangoTutorial/blob/238787c83ef8515aeeb405577980e71ff35664e8/Library/views.py

 Let me know how I might help get this fixed sooner, given ti was reported
 3 years ago and is still not fixed!

-- 
Ticket URL: <https://code.djangoproject.com/ticket/25705#comment:5>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to django-updates+unsubscr...@googlegroups.com.
To post to this group, send email to django-updates@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/django-updates/070.55fab0cfc4709c61e8150f2d821dde80%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.

Reply via email to