ColumnExpression doesn't escape column name containing . #46

Activity

1. Tishj commented on Sep 15, 2025

   

   Tishj

   on Sep 15, 2025

   Last edited by Tishj

   Member

   More actions

   Ah.. that's kind of an oversight 🤔
   The original behavior was to parse the string for components, later we added args * overload where the components can be added separately, keeping the existing behavior for size==1 to be backwards compatible

   But that falls apart when your column reference has dots in the name..

   original behavior was this:

   shared_ptr<DuckDBPyExpression> DuckDBPyExpression::ColumnExpression(const string &column_name) {
   	if (column_name == "*") {
   		return StarExpression();
   	}
   
   	auto qualified_name = QualifiedName::Parse(column_name);
   	vector<string> column_names;
   	if (!qualified_name.catalog.empty()) {
   		column_names.push_back(qualified_name.catalog);
   	}
   	if (!qualified_name.schema.empty()) {
   		column_names.push_back(qualified_name.schema);
   	}
   	column_names.push_back(qualified_name.name);
   
   	return make_shared<DuckDBPyExpression>(make_uniq<duckdb::ColumnRefExpression>(std::move(column_names)));
   }

   Which also doesn't support this case

   One thing I can think of that would still be backwards compatible is adding a kwarg: *, parse_string: Optional[bool] = True
2. Tishj commented on Sep 15, 2025

   

   Tishj

   on Sep 15, 2025

   Member

   More actions

   Though at that point, adding the quotes to your string is easier..

   import duckdb
   
   rel = duckdb.sql("""select * from values (1, 2), (3, 4) df(a, "b.a")""")
   rel.select(duckdb.ColumnExpression('"b.a"')).show()

   ┌───────┐
   │  b.a  │
   │ int32 │
   ├───────┤
   │     2 │
   │     4 │
   └───────┘
   
3. evertlammerts commented on Oct 27, 2026

   

   evertlammerts

   on Oct 27, 2026

   Member

   More actions

   In duckdb 2.0.0 a string passed to ColumnExpression or duckdb.col is one column name, quoted whole and never split, so rel.select(duckdb.ColumnExpression('b.a')) now returns the b.a column. I verified that on 2.0.0 and on main. Two spellings changed meaning as a result: the pre-quoted '"b.a"' workaround above now looks for a column whose name includes the quotes, and a qualified column is written as ColumnExpression('t', 'x') instead of 't.x'. Closing this as fixed in 2.0.0.

   🎉React with 🎉1Reacted by Marco Edward Gorelli
4. evertlammerts

   closed this as completedon Oct 27, 2026