Question

I’m adding and clauses dynamically in a turbogears controller, everything works fine until I get to a date column, it seems that it fails to evaluate the expression since I get a “ProgrammingError” in turbogears. This is the code:

terms = ["create_time<=DateTime('2012-01-01')"]
records = DBSession.query(myrecords).filter(and_(*terms))

if I do it like this it works:

records = DBSession.query(myrecords).filter(and_(create_time<=DateTime('2012-01-01')))

What is it that I am overlooking?

Thanks

Answer 1

you need to send expression constructs in, just lose the quotes:

terms = [create_time<=DateTime('2012-01-01')]
records = DBSession.query(myrecords).filter(and_(*terms))

like someone else said, if you are actually getting strings from some other source, you’d need to run them through eval(). Make sure those strings are not from the outside world ! eval() needs to be used very carefully to prevent unauthorized code execution.