Skip to content

Commit e745943

Browse files
jpmckinneyclaude
andcommitted
Clarify the psycopg server-side binding note #162
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013mEwtfE72tX2eUWEHJb1Zs
1 parent 0d14a5c commit e745943

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

docs/services/postgresql.rst

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,13 +79,13 @@ Construct SQL statements
7979

8080
`GitLab SQL Style Guide <https://handbook.gitlab.com/handbook/enterprise-data/platform/sql-style-guide/>`__
8181

82-
Follow `best practices <https://www.psycopg.org/psycopg3/docs/basic/params.html>`__ to avoid accidental errors and `SQL injection <https://en.wikipedia.org/wiki/SQL_injection>`__. The code samples below use the :ref:`psycopg<requirements-psycopg>` Python package.
82+
Follow `best practices <https://www.psycopg.org/psycopg3/docs/basic/params.html>`__ to avoid accidental errors and `SQL injection <https://en.wikipedia.org/wiki/SQL_injection>`__. The code samples below use the psycopg Python package.
8383

8484
.. note::
8585

86-
psycopg 3 binds parameters `server-side <https://www.psycopg.org/psycopg3/docs/basic/from_pg2.html#server-side-binding>`__ by default. This only matters if code passes runtime parameters where the extended protocol disallows them – for example, multiple statements in one ``execute``, or some ``SET`` and other session commands. In that case, use a `ClientCursor <https://www.psycopg.org/psycopg3/docs/advanced/cursors.html#client-side-binding-cursors>`__; otherwise, no change is needed. Queries that only compose identifiers into the SQL text (below) are unaffected.
86+
Unlike ``psycopg2``, psycopg 3 binds query parameters `server-side <https://www.psycopg.org/psycopg3/docs/basic/from_pg2.html#server-side-binding>`__ by default. A few cases don't support server-side binding, such as running multiple statements in one ``execute`` call, or session commands like ``SET``. If you pass parameters in one of those cases, run the query through a `ClientCursor <https://www.psycopg.org/psycopg3/docs/advanced/cursors.html#client-side-binding-cursors>`__, which binds parameters client-side as ``psycopg2`` did. Otherwise – including the identifier composition below – no change is needed.
8787

88-
- `Pass parameters to SQL queries <https://www.psycopg.org/psycopg3/docs/basic/params.html>`__, using the second argument to the ``execute`` method. This adapts the Python value's type (like ``bool``, ``int``, ``str``) to the correct SQL representation:
88+
- Pass parameters to SQL queries, using the second argument to the ``execute`` method. This adapts the Python value's type (like ``bool``, ``int``, ``str``) to the correct SQL representation:
8989

9090
.. code-block:: python
9191

0 commit comments

Comments
 (0)