On Thu, Oct 22, 2020 at 10:58:00AM +0200, Hans Ginzel wrote:

Hello,

consider this snippet please

cursor.execute(f"INSERT INTO {table} VALUES (1, '{}');") SyntaxError: f-string: empty expression not allowed

Escape the braces by doubling them: f"INSERT INTO {table} VALUES (1, '{{}}');"

It is (absolutely) correct to insert empty json into database table field.

Sure, but the syntax error has nothing to do with the database. The syntax error occurs long before the SQL gets executed. The problem here is with the f-string, not the call to cursor.execute. We can simplify the example to this: f'{}' and avoid the distraction of JSON, SQL, databases, etc.

Empty expression in f-string should * (silently) expand as '{}' (opening and closing braces), * generate a (compile time) warning if requested, e.g. with -W.

We could do that, but this is more likely to just hide bugs in the f-string than be useful. -- Steve

On Thu, 22 Oct 2020 at 11:39, Hans Ginzel wrote:

On Thu, Oct 22, 2020 at 08:31:34PM +1100, Steven D'Aprano wrote:

...

...

cursor.execute(f"INSERT INTO {table} VALUES (1, '{}');") SyntaxError: f-string: empty expression not allowed

Escape the braces by doubling them: f"INSERT INTO {table} VALUES (1, '{{}}');"

Thank you for (ugly) workaorund.

Given that using an f-string is not advised in this context (it's a vector for SQL injection attacks) I don't see this as a compelling example, and I think the workaround is perfectly fine - ugliness (if you choose to think of it as ugly) is arguably a benefit, because it forces you to think about whether you want to do this.

...

The problem here is with the f-string, not the call to cursor.execute. We can simplify the example to this: f'{}' and avoid the distraction of JSON, SQL, databases, etc.

Technically we can, but the context give us a useful example. Strings like f"Use braces ({}) for {something}." are also a useful example.

It does, and as I say above, it shows that having to double the brackets is fine (in my view).

...

...

Empty expression in f-string should * (silently) expand as '{}' (opening and closing braces), * generate a (compile time) warning if requested, e.g. with -W.

We could do that, but this is more likely to just hide bugs in the f-string than be useful.

Thank you, that would be great and useful. Users will be warned before potentially bug two times: 1) They will see the {} in output (which should be tested). 2) By the compiler when they ask for (-W), which is a better behaviour than forced carefulness.

"We could do that" doesn't mean we will. And I'm definitely -1 on it, for the reason Steven stated (it is more likely to hide bugs than to be useful). It's also an odd special case that users will have to understand ("to get a literal { or } character, double it, unless you want using precisely {}, when you don't have to double the characters but you can use {}. You can't use {{} or {}} though, these are right out") So no, I don't think this is a good idea, sorry. From the Zen, "Special cases aren't special enough to break the rules" is probably relevant here, and I don't think you have demonstrated that "Practicality beats purity" applies. Paul

On Thu, 22 Oct 2020 at 12:36, Hans Ginzel wrote:

On Thu, Oct 22, 2020 at 08:31:34PM +1100, Steven D'Aprano wrote:

...

...

cursor.execute(f"INSERT INTO {table} VALUES (1, '{}');") SyntaxError: f-string: empty expression not allowed

Escape the braces by doubling them: f"INSERT INTO {table} VALUES (1, '{{}}');"

Thank you for (ugly) workaorund.

It's not ugly for me too, but if you want another workaround: d = {} f"INSERT INTO {table} VALUES (1, '{d}');"

On Thu, Oct 22, 2020 at 11:32:36PM +1100, Chris Angelico wrote:

My recommendation here would be to separate the part where you insert a table name from the rest of the statement: cursor.execute(f"INSERT INTO {table} " "VALUES (1, '{}')") That way, you aren't at risk of SQL injection in the rest of the statement, and you have a very clear separation saying "hey this bit is doing something really unusual and using interpolation in SQL".

Thank you, that is the best suggestion. -- H.

On Thu, Oct 22, 2020 at 12:29:22PM +0200, Hans Ginzel wrote:

...

We could do that, but this is more likely to just hide bugs in the f-string than be useful.

Thank you, that would be great and useful.

Oh, sorry Hans, I think that you may have misunderstood me. In English, "We could do that, but..." usually means we won't do it because of the given reason. In this case, that is what I meant. We could do it, but we shouldn't. -- Steve

On Thu, Oct 22, 2020, at 21:00, Steven D'Aprano wrote:

"Who"? Syntax is a person now?

For what it's worth, I don't think escaping special symbols is ugly. More like homely. It does the job, plainly and simply, but I don't think it's especially good looking. Every other character stands for itself, with this handful of exceptional cases.

I suspect that calling this particular syntax ugly is picking at a bit of an open wound in the history f-string implementation... consider precisely why the escaping syntax is {{}} instead of \{\}, and all the implications of that. (with the PEG parser, incidentally, I wonder if it may be time to revisit certain limitations in f-string syntax, though that particular one technically presents a backward compatibility problem that the rest don't)

On Thu, Oct 22, 2020 at 11:08 PM Random832 wrote:

(with the PEG parser, incidentally, I wonder if it may be time to revisit certain limitations in f-string syntax, though that particular one technically presents a backward compatibility problem that the rest don't)

That's been worked on at the Core dev sprint that's currently winding down. But the quoting won't change. -- --Guido van Rossum (python.org/~guido) *Pronouns: he/him **(why is my pronoun here?)* http://feministing.com/2015/02/03/how-using-they-as-a-singular-pronoun-can-c...