Uploaded image for project: 'Spark'
  1. Spark
  2. SPARK-43205

Add an IDENTIFIER(stringLiteral) clause that maps a string to an identifier

    XMLWordPrintableJSON

Details

    • New Feature
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 3.5.0
    • 3.5.0
    • SQL
    • None

    Description

      There is a requirement for SQL templates, where the table and or column names are provided through substitution. This can be done today using variable substitution:
      SET hivevar:tabname = mytab;
      SELECT * FROM ${ hivevar:tabname };

      A straight variable substitution is dangerous since it does allow for SQL injection:
      SET hivevar:tabname = mytab, someothertab;
      SELECT * FROM ${ hivevar:tabname };

      A way to get around this problem is to wrap the variable substitution with a clause that limits the scope t produce an identifier.
      This approach is taken by Snowflake:
       https://docs.snowflake.com/en/sql-reference/session-variables#using-variables-in-sql

      SET hivevar:tabname = 'tabname';
      SELECT * FROM IDENTIFIER(${ hivevar:tabname })

      Attachments

        Activity

          People

            srielau Serge Rielau
            srielau Serge Rielau
            Wenchen Fan Wenchen Fan
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: