Skip to main content

Build Status pypi python license

SQL-tString allows for t-string based construction of sql queries without allowing for SQL injection. The basic usage is as follows,

from sql_tstring import sql

a = 1

query, values = sql(
    t"""SELECT a, b, c
          FROM tbl
         WHERE a = {a}""",
)

The query is a str and values a list[Any], both are then typically passed to a DB connection. Note the parameters can only be identifiers that identify variables (in the above example in the locals()) e.g. {a - 1} is not valid.

SQL-tString will convert parameters to SQL placeholders where appropriate. In other locations SQL-tString will allow pre defined column or table names to be used,

from sql_tstring import sql, sql_context

col = "a"
table = "tbl"

with sql_context(columns={"a"}, tables={"tbl"}):
    query, values = sql(
        t"SELECT {col} FROM {table}",
    )

If the value of col or table does not match the valid values given to the sql_context function an error will be raised.

Rewriting values

SQL-tString will also remove parameters if they are set to the special value of Absent (or RewritingValue.Absent). This is most useful for optional updates, or conditionals,

from sql_tstring import Absent, sql

a = Absent
b = Absent

query, values = sql(
    t"""UPDATE tbl
           SET a = {a},
               b = 1
         WHERE b = {b}""",
)

As both a and b are Absent the above query will be UPDATE tbl SET b =1.

In addition for conditionals the values IsNull (or RewritingValue.IS_NULL) and IsNotNull (or RewritingValue.IS_NOT_NULL) can be used to rewrite the conditional as expected. This is useful as x = NULL is always false in SQL.

Paramstyle (dialect)

By default SQL-tString uses the qmark paramstyle (dialect) but also supports the $ paramstyle or asyncpg dialect. This is best changed globally via,

from sql_tstring import Context, set_context

set_context(Context(dialect="asyncpg"))

Pre Python 3.14 usage

t-strings were introduced in Python 3.14 via, PEP 750, however this library can be used with Python 3.12 and 3.13 as follows,

from sql_tstring import sql

a = 1

query, values = sql(
    """SELECT a, b, c
         FROM tbl
        WHERE a = {a}""",
    locals(),
)

Please note though that only simple variable identifiers can be placed within the braces.

Metadata

Release files for sql-tstring 0.4.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for sql-tstring 0.4.0
File Size Uploaded Provenance
sql_tstring-0.4.0.tar.gz 12.2 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for sql-tstring 0.4.0
File Interpreter ABI Platform
sql_tstring-0.4.0-py3-none-any.whl Python 3 none any Details

Total release size: 22.4 kB

Release files / sql_tstring-0.4.0.tar.gz

Download URL sql_tstring-0.4.0.tar.gz
Size 12.2 kB
Tags Source
SHA-256 checksum
How to use checksums
ae046930e134692ac222e817e1cef77dd1d6aad4c2a10b47a45bff1b9043afa5
BLAKE2b-256 checksum
How to use checksums
e718a1829e1ca3815abfdd5a8b80890be8924b8f72740ac5a09475b0aa42fa61
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.12.9

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 6, 2025.

Transparency log

Release files / sql_tstring-0.4.0-py3-none-any.whl

Download URL sql_tstring-0.4.0-py3-none-any.whl
Size 10.2 kB
Tags Python 3
SHA-256 checksum
How to use checksums
004bf3baa59833296e6364726ce779273a92adbb2348e9c355ae8cf35e6ef44b
BLAKE2b-256 checksum
How to use checksums
b497f08f911ddd4cf970cdb253d6c4efa29c4265782256fb25ed5442f118b691
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.12.9

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 6, 2025.

Transparency log

Security for sql-tstring 0.4.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for sql_tstring-0.4.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Nov 6, 2025.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page