3 ms·
Show HN: Django/gevent view to download PostgreSQL table as CSV in single query
- philipkiely 7y agoThat is really neat! One thing I would point out is to make sure to sanitize the inputs table and schema, because they are passed directly into the SQL query they would be easy targets for a SQL injection if exposed to end users. I personally would add the validation within this view itself.
- michalc 7y agoHi, author here. I believe the inputs are already appropriately escaped by passing them through `sql.Identifier`. I have added a comment in the gist about this as well.
- philipkiely 7y agoThank you, my mistake!