Search code examples
pythonamazon-redshiftddlcreate-table

Create DDL statement from JSON file. How to avoid/minimize SQL injection?

I am working on a project which will require the user to enter the UI and create the table name on their own. Inputting table name and columns (column name, type, and other info).

Although it's easy to parametrize standard queries (i.e. insert/replace/update), I couldn't find ANY resource on how to parametrize DDL statements such as CREATE. Nor libraries that can handle that easily.

I was planning to apply (1) controls on the UI and (2) controls on the API I am going to call to run this DDL. But do you have any better idea/resource on how to get a CREATE statement from i.e. a JSON input? I am working on redshift.. Cheers!

Solution

  • I’ve used jinja2 templates and json config for this type of process. It integrates with python and can be used standalone. Just template your create table statements and apply the json config.