Add NEWS

erlend-aasland · erlend-aasland · commit 25365e9ba6c1 · 2023-02-08T18:21:03.000+01:00
diff --git a/Lib/test/test_sqlite3/test_dbapi.py b/Lib/test/test_sqlite3/test_dbapi.py
@@ -861,6 +861,20 @@ def __getitem__(slf, x):
         with self.assertRaises(ZeroDivisionError):
             self.cu.execute("select name from test where name=?", L())
 
+    def test_execute_named_param_and_sequence(self):
+        dataset = (
+            ("select :a", (1,)),
+            ("select :a, ?, ?", (1, 2, 3)),
+            ("select ?, :b, ?", (1, 2, 3)),
+            ("select ?, ?, :c", (1, 2, 3)),
+        )
+        msg = "Binding.*is a named parameter"
+        for query, params in dataset:
+            with self.subTest(query=query, params=params):
+                with self.assertWarnsRegex(DeprecationWarning, msg) as cm:
+                    self.cu.execute(query, params)
+                self.assertEqual(cm.filename,  __file__)
+
     def test_execute_too_many_params(self):
         category = sqlite.SQLITE_LIMIT_VARIABLE_NUMBER
         msg = "too many SQL variables"
diff --git a/Misc/NEWS.d/next/Library/2023-02-08-18-20-58.gh-issue-101693.4_LPXj.rst b/Misc/NEWS.d/next/Library/2023-02-08-18-20-58.gh-issue-101693.4_LPXj.rst
@@ -0,0 +1,2 @@
+In :meth:`~sqlite3.Cursor.execute`, deprecate using named placeholders with
+parameters supplied as a :term:`sequence`. Patch by Erlend E. Aasland.
diff --git a/Modules/_sqlite/cursor.c b/Modules/_sqlite/cursor.c
@@ -662,6 +662,17 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self,
             return;
         }
         for (i = 0; i < num_params; i++) {
+            const char *name = sqlite3_bind_parameter_name(self->st, i+1);
+            if (name != NULL) {
+                PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
+                                 "Binding %d ('%s') is a named parameter, "
+                                 "but you supplied a sequence which requires "
+                                 "nameless (qmark) placeholders. "
+                                 "Starting with Python 3.14 an "
+                                 "sqlite3.ProgrammingError will be raised.",
+                                 i+1, name);
+            }
+
             if (PyTuple_CheckExact(parameters)) {
                 PyObject *item = PyTuple_GET_ITEM(parameters, i);
                 current_param = Py_NewRef(item);

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+In :meth:`~sqlite3.Cursor.execute`, deprecate using named placeholders with
	`2`	+parameters supplied as a :term:`sequence`. Patch by Erlend E. Aasland.