R: Quote identifiers

dbQuoteIdentifier {DBI} | R Documentation

## Quote identifiers

### Description

Call this method to generate a string that is suitable for use in a query as a column name, to make sure that you generate valid SQL and avoid SQL injection.

### Usage

    dbQuoteIdentifier(conn, x, ...)

### Arguments

`conn` | A subclass of DBIConnection, representing an active connection to an DBMS.
`x` | A character vector to quote as identifier.
`...` | Other arguments passed on to methods.

### Value

`dbQuoteIdentifier()` returns an object that can be coerced to character, of the same length as the input. For an empty character vector this function returns a length-0 object. An error is raised if the input contains `NA`, but not for an empty string.

When passing the returned object again to `dbQuoteIdentifier()` as `x` argument, it is returned unchanged. Passing objects of class SQL should also return them unchanged. (For backends it may be most convenient to return SQL objects to achieve this behavior, but this is not required.)

### Specification

Calling `dbGetQuery()` for a query of the format `SELECT 1 AS ...` returns a data frame with the identifier, unquoted, as column name. Quoted identifiers can be used as table and column names in SQL queries, in particular in queries like `SELECT 1 AS ...` and `SELECT * FROM (SELECT 1) ...`. This is also true for column names that are empty strings or contain special characters such as a space, a dot, a comma, or quotes used to mark strings or identifiers, if the database supports this. In any case, checking the validity of the identifier should be performed only when executing a query, and not by `dbQuoteIdentifier()`.

### See Also

Other DBIResult generics: `DBIResult-class`, `dbBind`, `dbClearResult`, `dbColumnInfo`, `dbFetch`, `dbGetInfo`, `dbGetRowCount`, `dbGetRowsAffected`, `dbGetStatement`, `dbHasCompleted`, `dbIsValid`, `dbQuoteString`

### Examples

    # Quoting ensures that arbitrary input is safe for use in a query
    name <- "Robert'); DROP TABLE Students;--"
    dbQuoteIdentifier(ANSI(), name)

    # SQL vectors are always passed through as is
    var_name <- SQL("select")
    var_name

    dbQuoteIdentifier(ANSI(), var_name)

    # This mechanism is used to prevent double escaping
    dbQuoteIdentifier(ANSI(), dbQuoteIdentifier(ANSI(), name))

[Package DBI version 0.6-1 Index]