Ticket #12923: last_executed_query.patch

django/db/backends/mysql/base.py

@@ -224 +224 @@
         second = '%s-12-31 23:59:59.99'
         return [first % value, second % value]
 
+    def construct_query(self, cursor, sql, params):
+        return sql % tuple(cursor.connection.literal(param) for param in params)
+
 class DatabaseWrapper(BaseDatabaseWrapper):
 
     operators = {

django/db/backends/__init__.py

@@ -212 +212 @@
         else:
             u_params = dict([(to_unicode(k), to_unicode(v)) for k, v in params.items()])
 
-        return smart_unicode(sql) % u_params
+        return self.construct_query(cursor, smart_unicode(sql), u_params)
 
+    def construct_query(self, cursor, sql, params):
+        """
+        Returns a string of the query that results of composing the
+        parameters into the given sql template.
+
+        `sql` is the raw query containing placeholders, and `params` is the
+        sequence of parameters. The result is the combination of both.
+        Additionally, `cursor` is provided for use by backends that may
+        need it.
+        """
+        return sql % tuple(['"' + param.replace('"', '""') + '"' for param in params])
+
     def last_insert_id(self, cursor, table_name, pk_name):
         """
         Given a cursor object that has just performed an INSERT statement into

tests/regressiontests/backends/tests.py

@@ -34 +34 @@
             c.execute('DROP TABLE ltext')
             self.assertEquals(long_str, row[0].read())
 
+class LastExecutedQuery(unittest.TestCase):
+
+    def test_last_executed_query(self):
+        c = connection.cursor()
+        c.execute('CREATE TABLE last_executed_query (example1 VARCHAR(255), example2 VARCHAR(255))')
+        query = 'INSERT INTO last_executed_query (example1, example2) VALUES (%s, %s)'
+        args = ('dangerous"string', "more'danger")
+        c.execute(query, args)
+        
+        expectation = {
+            'django.db.backends.sqlite3': u'INSERT INTO last_executed_query (example1, example2) VALUES ("dangerous""string", "more\'danger")',
+            'django.db.backends.mysql': u"INSERT INTO last_executed_query (example1, example2) VALUES ('dangerous\\\"string', 'more\\'danger')",
+        }[settings.DATABASES[DEFAULT_DB_ALIAS]['ENGINE']]
+
+        self.assertEquals(expectation, connection.ops.last_executed_query(c, query, args))
+
+
 def connection_created_test(sender, **kwargs):
     print 'connection_created signal'