"""Debugging utils.""" import datetime from sqlalchemy import orm def render_query(query, bind=None): """Generate an SQL expression string with bound parameters rendered inline. This works with SQLAlchemy statements. WARNING: This method of escaping is insecure, incomplete, and for debugging purposes only. Executing SQL statements with inline-rendered user values is extremely insecure. Based on stackoverflow.com/questions/5631078/sqlalchemy-print-the-actual-query Args: query (sqlalchemy.orm.query.Query): SQLalchemy query statement. Returns: str: query statement as a raw SQL string. """ if isinstance(query, orm.query.Query): if bind is None: bind = query.session.get_bind(query._mapper_zero()) query = query.statement elif bind is None: bind = query.bind class LiteralCompiler(bind.dialect.statement_compiler): def visit_bindparam( self, bindparam, within_columns_clause=False, literal_binds=False, **kwargs): return self.render_literal_value(bindparam.value, bindparam.type) def render_literal_value(self, value, type_): if isinstance(value, float): return str(value) elif isinstance(value, (datetime.date, datetime.datetime)): return "'%s'" % value return super(LiteralCompiler, self).render_literal_value( value, type_) return LiteralCompiler(bind.dialect, query).process(query)