Question

I am having the same problem as:
python adds "E" to string

All the answers given are relevant, but I am breaking my neck on this one.

The problem is that psycopg2 not only escapes values, but also schema, table and column names like this:

CREATE TABLE E'Tablename' (E'identificatie' VARCHAR(16))

Which it simply shouldn’t! How van I get rid of the E and ” for table names and columns but maintain them for field values?

the alternative

'CREATE TABLE ' + tablename + ' (' + fieldname... %

makes it vulnerable to sql injection all over again.

Stuck between a rock and a hard place..

Answer 1

It is, for better or worse, generally not supported by the Python interfaces and Psycopg in particular to substitute user-supplied identifiers into SQL commands. You will have to roll your own. It can be done with a few lines of code.