Parameterize database query in SQL Server schema collection (#23381)

* Parameterize database query in SQL Server schema collection

* Lint

* Changelog

Author: sethsamuel

sqlserver/changelog.d/23381.fixed

@@ -0,0 +1 @@
+Parameterize database query in SQL Server schema collection

sqlserver/datadog_checks/sqlserver/queries.py

@@ -4,6 +4,7 @@
 
 from datadog_checks.sqlserver.database_metrics.xe_session_metrics import XE_RING_BUFFER
 
+# `{}` is replaced with comma-separated ODBC `?` placeholders (values bound via parameters).
 DB_QUERY = """
 SELECT
     db.database_id AS id, db.name AS name, db.collation_name AS collation, dp.name AS owner

sqlserver/datadog_checks/sqlserver/schemas.py

@@ -100,8 +100,11 @@ def _get_databases(self):
         database_names = self._check.get_databases()
         with self._check.connection.open_managed_default_connection(KEY_PREFIX):
             with self._check.connection.get_managed_cursor(KEY_PREFIX) as cursor:
-                db_names_formatted = ",".join(["'{}'".format(t) for t in database_names])
-                return execute_query(DB_QUERY.format(db_names_formatted), cursor, convert_results_to_str=True)
+                if not database_names:
+                    return []
+                placeholders = ",".join(["?"] * len(database_names))
+                query = DB_QUERY.format(placeholders)
+                return execute_query(query, cursor, convert_results_to_str=True, parameters=tuple(database_names))
 
     @contextlib.contextmanager
     def _get_cursor(self, database_name):

sqlserver/datadog_checks/sqlserver/utils.py

@@ -211,9 +211,9 @@ def is_azure_sql_database(engine_edition):
     return engine_edition == ENGINE_EDITION_SQL_DATABASE
 
 
-def execute_query(query, cursor, convert_results_to_str=False, parameter=None) -> Dict[str, str]:
-    if parameter is not None:
-        cursor.execute(query, (parameter,))
+def execute_query(query, cursor, convert_results_to_str=False, parameters=None) -> Dict[str, str]:
+    if parameters is not None:
+        cursor.execute(query, parameters)
     else:
         cursor.execute(query)
     columns = [str(column[0]).lower() for column in cursor.description]