Merge pull request #417 from apollo13/sql_fixes

Fixed #383 -- Feed the proper SQL to cursor.execute (the one with placeholders).

Author: jezdez

debug_toolbar/forms.py

@@ -17,12 +17,14 @@ class SQLSelectForm(forms.Form):
     """
     Validate params
 
-        sql: urlencoded sql with positional arguments
+        sql: The sql statement with interpolated params
+        raw_sql: The sql statement with placeholders
         params: JSON encoded parameter values
         duration: time for SQL to execute passed in from toolbar just for redisplay
         hash: the hash of (secret + sql + params) for tamper checking
     """
     sql = forms.CharField()
+    raw_sql = forms.CharField()
     params = forms.CharField()
     alias = forms.CharField(required=False, initial='default')
     duration = forms.FloatField()
@@ -39,8 +41,8 @@ def __init__(self, *args, **kwargs):
         for name in self.fields:
             self.fields[name].widget = forms.HiddenInput()
 
-    def clean_sql(self):
-        value = self.cleaned_data['sql']
+    def clean_raw_sql(self):
+        value = self.cleaned_data['raw_sql']
 
         if not value.lower().strip().startswith('select'):
             raise ValidationError("Only 'select' queries are allowed.")
@@ -72,8 +74,7 @@ def clean_hash(self):
         return hash
 
     def reformat_sql(self):
-        sql, params = self.cleaned_data['sql'], self.cleaned_data['params']
-        return reformat_sql(self.cursor.db.ops.last_executed_query(self.cursor, sql, params))
+        return reformat_sql(self.cleaned_data['sql'])
 
     def make_hash(self, data):
         params = force_text(settings.SECRET_KEY) + data['sql'] + data['params']

debug_toolbar/views.py

@@ -19,7 +19,7 @@ def sql_select(request):
     form = SQLSelectForm(request.POST or None)
 
     if form.is_valid():
-        sql = form.cleaned_data['sql']
+        sql = form.cleaned_data['raw_sql']
         params = form.cleaned_data['params']
         cursor = form.cursor
         cursor.execute(sql, params)
@@ -43,7 +43,7 @@ def sql_explain(request):
     form = SQLSelectForm(request.POST or None)
 
     if form.is_valid():
-        sql = form.cleaned_data['sql']
+        sql = form.cleaned_data['raw_sql']
         params = form.cleaned_data['params']
         cursor = form.cursor
 
@@ -80,7 +80,7 @@ def sql_profile(request):
     form = SQLSelectForm(request.POST or None)
 
     if form.is_valid():
-        sql = form.cleaned_data['sql']
+        sql = form.cleaned_data['raw_sql']
         params = form.cleaned_data['params']
         cursor = form.cursor
         result = None