Redash does not escape quotes in parameter values

Running the following query:

SELECT '{{value}}'

With value being McDonald's will return an error, because ' is not escaped. We need to apply escaping and it needs to be query runner specific.

Current workaround is for the user to do the escaping when providing the value.

[daboooo]

Yes, it’s very annoying… We would like to use Redash for production environnement but it’s not possible because of this issue.

[mbra]

Though I am a bit hesitant to share at this point, I have come up with a couple commits that might be a start to solving this.

I started by reworking the parameter validation code a bit to simplify writing per type validation/normalization logic and to get a feel for that part of the code base. Before adding the escaping feature I added the unrelated feature of “Optional parameters” to get a better understanding of the interaction between frontend and the API, resulting in 3 main commits as well as a couple of smaller ones to fix some deprecation warnings.

I would not say this is ready for a PR yet, mostly because I feel like I am not comfortable with the codebase yet and I’d definitely not put everything in a single PR in the end.

It also only implements escaping for the PostgreSQL data source, but I guess adding it for your own data sources is not that big of a deal after checking out the pg.py diff. 😃

My current set of changes is at https://github.com/solute/redash/tree/improve_query_params