fix(sqlalchemy): address review comments - init_script as list, add query type validation, remove dead code, expand README

Author: SyedShahmeerAli12

integrations/sqlalchemy/README.md

@@ -7,6 +7,73 @@
 
 ---
 
+A Haystack integration for querying SQL databases via [SQLAlchemy](https://www.sqlalchemy.org/).
+Provides a `SQLAlchemyTableRetriever` component that connects to any SQLAlchemy-supported database,
+executes a SQL query, and returns results as a Pandas DataFrame and an optional Markdown table.
+
+## Installation
+
+```bash
+pip install sqlalchemy-haystack
+```
+
+You also need to install the appropriate database driver for your backend:
+
+| Backend | Driver package |
+|---------|---------------|
+| PostgreSQL | `psycopg2-binary` or `psycopg[binary]` |
+| MySQL / MariaDB | `pymysql` or `mysqlclient` |
+| SQLite | built-in (no extra package needed) |
+| MSSQL | `pyodbc` |
+| Oracle | `cx_oracle` or `oracledb` |
+
+## Usage
+
+```python
+from haystack_integrations.components.retrievers.sqlalchemy import SQLAlchemyTableRetriever
+
+# SQLite in-memory example (no driver needed)
+retriever = SQLAlchemyTableRetriever(
+    drivername="sqlite",
+    database=":memory:",
+    init_script=[
+        "CREATE TABLE products (id INTEGER, name TEXT, price REAL)",
+        "INSERT INTO products VALUES (1, 'Widget', 9.99)",
+        "INSERT INTO products VALUES (2, 'Gadget', 19.99)",
+    ],
+)
+retriever.warm_up()
+
+result = retriever.run(query="SELECT * FROM products WHERE price < 15")
+print(result["dataframe"])
+print(result["table"])
+```
+
+For PostgreSQL:
+
+```python
+from haystack.utils import Secret
+
+retriever = SQLAlchemyTableRetriever(
+    drivername="postgresql+psycopg2",
+    host="localhost",
+    port=5432,
+    database="mydb",
+    username="myuser",
+    password=Secret.from_env_var("DB_PASSWORD"),
+)
+```
+
+## Security
+
+This component executes raw SQL queries passed at runtime. Keep the following in mind:
+
+- **Never pass unsanitised user input** directly as a query — this exposes you to SQL injection.
+- **Use a read-only database user.** This is the most effective mitigation. Even if a malicious
+  query is executed, a read-only user cannot modify or delete data.
+- **Restrict database permissions** to the minimum required — specific tables and schemas only,
+  no DDL privileges (no `CREATE`, `DROP`, `ALTER`).
+
 ## Contributing
 
 Refer to the general [Contribution Guidelines](https://github.com/deepset-ai/haystack-core-integrations/blob/main/CONTRIBUTING.md).

integrations/sqlalchemy/src/haystack_integrations/components/retrievers/sqlalchemy/sqlalchemy_table_retriever.py

@@ -48,7 +48,7 @@ def __init__(
         host: str | None = None,
         port: int | None = None,
         database: str | None = None,
-        init_script: str | None = None,
+        init_script: list[str] | None = None,
     ) -> None:
         """
         Initialize SQLAlchemyTableRetriever.
@@ -60,9 +60,9 @@ def __init__(
         :param host: Database host.
         :param port: Database port.
         :param database: Database name or path (e.g., ``":memory:"`` for SQLite in-memory).
-        :param init_script: Optional SQL statements executed once on ``warm_up()``
-            (e.g., to create tables or insert seed data). Multiple statements should be
-            separated by semicolons.
+        :param init_script: Optional list of SQL statements executed once on ``warm_up()``
+            (e.g., to create tables or insert seed data). Each statement should be a
+            separate string in the list.
         """
         self.drivername = drivername
         self.username = username
@@ -101,7 +101,7 @@ def warm_up(self) -> None:
 
         if self.init_script:
             with self._engine.connect() as conn:
-                for stmt in self.init_script.split(";"):
+                for stmt in self.init_script:
                     stripped = stmt.strip()
                     if stripped:
                         conn.execute(text(stripped))
@@ -158,16 +158,16 @@ def run(self, query: str) -> dict[str, Any]:
             - ``table``: A Markdown-formatted string of the results.
             - ``error``: An error message if the query failed, otherwise an empty string.
         """
+        if not isinstance(query, str):
+            logger.warning("Query is not a string, returning empty DataFrame")
+            return {"dataframe": DataFrame(), "table": "", "error": "query is not a string"}
+
         if not query:
             return {"dataframe": DataFrame(), "table": "", "error": "empty query"}
 
         if not self._warmed_up:
             self.warm_up()
 
-        if self._engine is None:
-            msg = "Engine is not initialized. Call warm_up() first."
-            raise RuntimeError(msg)
-
         try:
             with self._engine.connect() as conn:
                 result = conn.execute(text(query))

integrations/sqlalchemy/tests/test_sqlalchemy_table_retriever.py

@@ -29,15 +29,15 @@ def test_init_all_params(self):
             host="localhost",
             port=5432,
             database="mydb",
-            init_script="CREATE TABLE t (x INTEGER)",
+            init_script=["CREATE TABLE t (x INTEGER)"],
         )
         assert retriever.drivername == "postgresql+psycopg2"
         assert retriever.username == "user"
         assert retriever.password is password
         assert retriever.host == "localhost"
         assert retriever.port == 5432
         assert retriever.database == "mydb"
-        assert retriever.init_script == "CREATE TABLE t (x INTEGER)"
+        assert retriever.init_script == ["CREATE TABLE t (x INTEGER)"]
 
 
 class TestSQLAlchemyTableRetrieverSerialization:
@@ -77,17 +77,12 @@ def test_from_dict(self, monkeypatch):
 class TestSQLAlchemyTableRetrieverRun:
     @pytest.fixture()
     def retriever_with_data(self):
-        init_sql = (
-            "CREATE TABLE employees ("
-            "  id INTEGER PRIMARY KEY,"
-            "  name TEXT NOT NULL,"
-            "  department TEXT NOT NULL,"
-            "  salary INTEGER NOT NULL"
-            ");"
-            "INSERT INTO employees VALUES (1, 'Alice', 'Engineering', 95000);"
-            "INSERT INTO employees VALUES (2, 'Bob', 'Marketing', 72000);"
-            "INSERT INTO employees VALUES (3, 'Carol', 'Engineering', 88000)"
-        )
+        init_sql = [
+            "CREATE TABLE employees (id INTEGER PRIMARY KEY, name TEXT NOT NULL, department TEXT NOT NULL, salary INTEGER NOT NULL)",
+            "INSERT INTO employees VALUES (1, 'Alice', 'Engineering', 95000)",
+            "INSERT INTO employees VALUES (2, 'Bob', 'Marketing', 72000)",
+            "INSERT INTO employees VALUES (3, 'Carol', 'Engineering', 88000)",
+        ]
         retriever = SQLAlchemyTableRetriever(
             drivername="sqlite",
             database=":memory:",
@@ -96,6 +91,13 @@ def retriever_with_data(self):
         retriever.warm_up()
         return retriever
 
+    def test_run_non_string_query(self):
+        retriever = SQLAlchemyTableRetriever(drivername="sqlite", database=":memory:")
+        result = retriever.run(query=123)  # type: ignore[arg-type]
+        assert result["error"] == "query is not a string"
+        assert result["dataframe"].empty
+        assert result["table"] == ""
+
     def test_run_empty_query(self):
         retriever = SQLAlchemyTableRetriever(drivername="sqlite", database=":memory:")
         result = retriever.run(query="")
@@ -132,9 +134,12 @@ def test_run_sql_error(self):
         assert result["dataframe"].empty
 
     def test_max_row_limit(self, monkeypatch):
-        init_sql = (
-            "CREATE TABLE t (x INTEGER);INSERT INTO t VALUES (1);INSERT INTO t VALUES (2);INSERT INTO t VALUES (3)"
-        )
+        init_sql = [
+            "CREATE TABLE t (x INTEGER)",
+            "INSERT INTO t VALUES (1)",
+            "INSERT INTO t VALUES (2)",
+            "INSERT INTO t VALUES (3)",
+        ]
         retriever = SQLAlchemyTableRetriever(
             drivername="sqlite",
             database=":memory:",
@@ -146,7 +151,7 @@ def test_max_row_limit(self, monkeypatch):
         assert len(result["dataframe"]) == 2
 
     def test_warm_up_with_init_script(self):
-        init_sql = "CREATE TABLE greetings (msg TEXT); INSERT INTO greetings VALUES ('hello')"
+        init_sql = ["CREATE TABLE greetings (msg TEXT)", "INSERT INTO greetings VALUES ('hello')"]
         retriever = SQLAlchemyTableRetriever(
             drivername="sqlite",
             database=":memory:",