feat(sql): add parameterized query support

[Lucas61000]

Changes Made

Add parameterized query support to daft.sql() to prevent SQL injection attacks.

• Add params argument supporting three parameter styles:
  • Auto-incremented: ? (sequential substitution)
  • Positional: $1, $2, $3... (indexed substitution)
  • Named: :name (named substitution from dict)
• Validate that only one parameter style is used per query

Related Issues

Closes #4156

[greptile-apps]

Greptile Summary

This PR adds parameterized query support to daft.sql() via a new params argument, implementing three placeholder styles (?, $n, :name) through Python-side string substitution before the SQL is forwarded to Daft's SQL engine.

• P0 — SQL injection: _format_sql_value embeds strings without escaping internal single quotes. A value like \"' OR '1'='1\" becomes '' OR '1'='1' in the final SQL, defeating the stated injection-prevention goal entirely.
• P1 — Broken doctests: All three parameterized docstring examples pass the params list/dict as the second positional argument, which binds to register_globals rather than params; $1/$2 and :name examples also show incorrect expected output.
• P1 — ::TYPE cast false positives: The :(\\w+) regex matches inside PostgreSQL-style ::INTEGER casts, causing spurious "parameter not found" or "cannot mix styles" errors.

Confidence Score: 3/5

Not safe to merge: the feature's primary goal (injection prevention) is unmet, doctests are broken, and ::TYPE casts cause false errors.

A P0 security issue (unescaped single quotes enabling SQL injection), two P1 logic issues (broken docstring examples, ::TYPE cast false positives), and broken doctests that would fail make doctests in CI collectively block this PR.

daft/sql/sql.py — _format_sql_value (single-quote escaping), _apply_parameters (:(\w+) regex for casts), and all three parameterized docstring examples.

Security Review

• SQL injection via unescaped single quotes (daft/sql/sql.py, _format_sql_value): string values are interpolated as '<value>' without escaping internal ' characters. A value such as \"' OR '1'='1\" renders as '' OR '1'='1', producing a tautology that returns every row. This directly contradicts the PR's stated purpose of preventing SQL injection.

Important Files Changed

Filename	Overview
daft/sql/sql.py	Adds _apply_parameters and _format_sql_value helpers plus a params arg to sql(); has a P0 SQL-injection bug (unescaped single quotes), P1 broken doctests, and P1 false-positive named-param detection on ::TYPE casts.
tests/sql/test_parameterized_queries.py	Adds 8 tests covering all three placeholder styles and error cases with correct params= keyword usage, but no test covers injection-safety (strings with single quotes).

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["daft.sql(sql, params=...)"] --> B{params is None?}
    B -- Yes --> E[Pass SQL as-is to _sql_exec]
    B -- No --> C["_apply_parameters(sql, params)"]
    C --> D{type of params?}
    D -- dict --> F["re.sub replace_named\n⚠️ Also matches ::TYPE casts"]
    D -- list/tuple --> G{Detect style}
    G --> H[has_dollar]
    G --> I[has_question]
    G --> J["has_named\n⚠️ False-positive on ::TYPE"]
    H & I & J --> K{style_count > 1?}
    K -- Yes --> L[raise ValueError: Cannot mix]
    K -- No --> M{has_dollar?}
    M -- Yes --> N[replace_indexed]
    M -- No --> O[replace_question]
    N & O & F --> P["_format_sql_value\n⚠️ No single-quote escaping"]
    P --> Q[Substituted SQL]
    Q --> E
    E --> R[DataFrame result]

Loading

_{Reviews (1): Last reviewed commit: "feat(sql): add parameterized query suppo..." | Re-trigger Greptile}