Note that DBI::dbUnquoteIdentifier() succeeds in the first case but errors out with the injection.
The SQL input should therefore be validated via dbUnquoteIdentifier(): if it runs, great. If it instead throws an error, then you've likely got a problem.
Thanks, interesting idea. This would protect users from shooting themselves in the foot, but requires that dbUnquoteIdentifier() works in all conceivable cases.
Currently
dbQuoteIdentifier()
simply returnsx
if it is SQL. This is dangerous, since it is an avenue for injection.Created on 2022-03-01 by the reprex package (v2.0.1)
Note that
DBI::dbUnquoteIdentifier()
succeeds in the first case but errors out with the injection.The SQL input should therefore be validated via
dbUnquoteIdentifier()
: if it runs, great. If it instead throws an error, then you've likely got a problem.