Registry / database / sqlparams

sqlparams

JSON →
library6.2.0pypypi✓ verified 25d ago

sqlparams is a utility package for converting between various SQL parameter styles. This can simplify the use of SQL parameters in queries by allowing the use of named parameters where only ordinal are supported. Current version is 6.2.0, released on 2024-01-25. It appears to have a regular release cadence, with several minor and major versions released annually.

pip install sqlparams
INSTALL
IMPORT
SIG · SQLPARAMS
S
sqlparams
databasepythonv6.2.0
Install
1.5s avg
Import
15ms
Disk
16MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v6.2.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.016s · 18MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 1.5s · import 0.014s · 18MB
16MB installed
● package 16MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

SQLParams
from sqlparams import SQLParams
from sqlparams import named, ordinal
The attributes 'named' and 'ordinal' on SQLParams were renamed to 'in_style' and 'out_style' respectively in version 6.0.0.

Demonstrates initializing SQLParams to convert from named to qmark style, then using the `format` method for single and tuple parameters, and `formatmany` for multiple sets of parameters.

import sqlparams # Convert from named style (e.g., ':name') to qmark style (e.g., '?') query_converter = sqlparams.SQLParams('named', 'qmark') # Example 1: Single parameter sql_in = "SELECT * FROM users WHERE name = :name;" params_in = {'name': "Thorin"} sql_out, params_out = query_converter.format(sql_in, params_in) print(f"Original SQL: {sql_in}") print(f"Original Params: {params_in}") print(f"Converted SQL: {sql_out}") print(f"Converted Params: {params_out}\n") # Expected: SELECT * FROM users WHERE name = ?; ['Thorin'] # Example 2: Tuple expansion for IN operator sql_in_in = "SELECT * FROM users WHERE name IN :names;" params_in_in = {'names': ("Dori", "Nori", "Ori")} sql_out_in, params_out_in = query_converter.format(sql_in_in, params_in_in) print(f"Original SQL (IN): {sql_in_in}") print(f"Original Params (IN): {params_in_in}") print(f"Converted SQL (IN): {sql_out_in}") print(f"Converted Params (IN): {params_out_in}\n") # Expected: SELECT * FROM users WHERE name in (?,?,?); ['Dori', 'Nori', 'Ori'] # Example 3: Multiple parameter sets for executemany sql_many_in = "UPDATE users SET age = :age WHERE name = :name;" params_many_in = [ {'name': "Dwalin", 'age': 169}, {'name': "Balin", 'age': 178} ] sql_many_out, params_many_out = query_converter.formatmany(sql_many_in, params_many_in) print(f"Original SQL (many): {sql_many_in}") print(f"Original Params (many): {params_many_in}") print(f"Converted SQL (many): {sql_many_out}") print(f"Converted Params (many): {params_many_out}") # Expected: UPDATE users SET age = ? WHERE name = ?; [[169, 'Dwalin'], [178, 'Balin']]
Debug
Known issues
breakingVersion 6.0.0 dropped support for Python 3.7 (which is End-of-Life). Additionally, the attributes `named` and `ordinal` on the `SQLParams` class were renamed to `in_style` and `out_style` respectively. The private attributes `match` and `replace` were also removed. Named parameters must now be valid identifiers and can no longer start with a digit.
fix
Upgrade to Python 3.8+ and update attribute access from `.named` to `.in_style` and `.ordinal` to `.out_style`. Ensure named parameters do not start with digits.
affects: >=6.0.0
gotchaWhen using tuple expansion (e.g., for `IN` clauses) with `SQLParams.formatmany()`, ensure that all tuples for a given parameter across *all* parameter sets have the exact same number of elements. If the tuple sizes vary, `formatmany()` will fail, and it's recommended to use `SQLParams.format()` in a loop instead for each parameter set.
fix
Maintain consistent tuple lengths across all parameter sets when using `formatmany()` with tuple expansion, or switch to calling `format()` individually for each parameter set.
affects: All versions
gotchaWhile `sqlparams` enables safe parameterized queries by converting parameter styles, it does not inherently prevent SQL injection if user input is directly concatenated into the SQL string *before* being processed by `sqlparams`. Always pass user-provided values exclusively through the parameters dictionary/list, never directly into the SQL query string itself.
fix
Strictly use `sqlparams.format()` or `sqlparams.formatmany()` with all user-supplied data placed in the `params` argument (as a dictionary or sequence), never concatenating it into the `sql` argument.
affects: All versions
Errors
Common errors & fixes
ValueError: unknown input style: 'invalid_style'
The `SQLParams` constructor was provided an unsupported or misspelled input parameter style name.
fix
Use one of the valid input styles: 'named', 'pyformat', or 'format'.
KeyError: 'user_id'
The SQL query contains a named parameter (e.g., `:user_id`) that is missing from the provided dictionary of bind parameters.
fix
Ensure all named parameters used in the SQL query have corresponding keys in the dictionary passed as `bind_params`.
AttributeError: 'list' object has no attribute 'items'
When using 'named' or 'pyformat' as the input style, the `bind_params` argument passed to `format` must be a dictionary, but a list (or other non-dict type) was provided.
fix
Pass a dictionary as the `bind_params` argument when using 'named' or 'pyformat' input styles.
TypeError: format() missing 1 required positional argument: 'self'
The `format` method was incorrectly called directly on the `SQLParams` class instead of on an instantiated object of the class.
fix
First, create an instance of `SQLParams` by calling its constructor (e.g., `params = SQLParams(...)`), then call the `format` method on that instance (e.g., `params.format(...)`).
Upgrade
Version history
6.2.0latest on PyPI · released Jan 25, 2025
Audit
Dependencies
pythonrequiredRequires Python 3.8 or newer.
Agent activity
24 hits · last 30 days
node
20
Meta
1
OpenAI (training)
1
Resources