Skip to content
This repository has been archived by the owner on Feb 22, 2020. It is now read-only.

Truncated data when escaping a single string argument #21

Closed
SteveAyre opened this issue Sep 11, 2012 · 4 comments
Closed

Truncated data when escaping a single string argument #21

SteveAyre opened this issue Sep 11, 2012 · 4 comments

Comments

@SteveAyre
Copy link

If a string to be escaped is passed in as either a single argument or in a tuple it gets truncated to the first character.

This does not occur if the string is passed within a list, or if multiple arguments are given.

Minimal test case:
import umysql
conn = umysql.Connection()
conn.connect('localhost', 3306, 'user', 'pass', 'test')
rs = conn.query("SELECT %s", 'abcdef')
print rs.rows[0][0]
rs = conn.query("SELECT %s", ('abcdef'))
print rs.rows[0][0]
rs = conn.query("SELECT %s", ['abcdef'])
print rs.rows[0][0]

It would be expected that all of these would function the same
abcdef
abcdef
abcdef
However the observed result is:
a
a
abcdef
Only the 3rd list usage works as expected.

The truncation occurs before the query, from the general query log:
4341 Query SELECT 'a'
4341 Query SELECT 'a'
4341 Query SELECT 'abcdef'

@mthurlin
Copy link
Member

('abcdef') <-- not a tuple
('abcdef', ) <-- tuple

Strings behave as sequences, so this is expected. Just as len("abcdef") gives 6 and not 1.
Pass in a tuple or a list to make it work.

@SteveAyre
Copy link
Author

While this might be the case, it does differ from DBAPI implementations such as MySQLdb

This code:
import MySQLdb
conn = MySQLdb.connect (host="localhost", user="user", passwd="pass", db="test")
cursor = conn.cursor()
cursor.execute("SELECT %s", 'abcdef')
cursor.execute("SELECT %s", ('abcdef'))
cursor.execute("SELECT %s", ['abcdef'])

Results in the following in the general query log:
4354 Query SELECT 'abcdef'
4354 Query SELECT 'abcdef'
4354 Query SELECT 'abcdef'

As you can see the full 'abcdef' string is used in all cases, not truncated.

@SteveAyre
Copy link
Author

It seems that the issue is not tuple related, but rather that a parameter of a single str should be treated as such for escaping and not as a sequence of characters.

@jskorpan
Copy link

jskorpan commented Oct 1, 2012

Sadly UltraMySQL isn't API compatible with Python's MySQLdb API

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants