[SPARK-41271] Parameterized SQL

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.4.0
• Fix Version/s: 3.4.0
• Component/s: SQL
• Assignee: Max Gekk
• Reporter: Max Gekk
• Created: 26/Nov/22 10:14
• Updated: 12/Aug/23 11:12
• Resolved: 15/Dec/22 06:14

Description

Enhance the Spark SQL API with support for parameterized SQL statements to improve security and reusability. Application developers will be able to write SQL with parameter markers whose values will be passed separately from the SQL code and interpreted as literals. This will help prevent SQL injection attacks for applications that generate SQL based on a user’s selections, which is often done via a user interface.

Issue Links

• is cloned by: SPARK-41666 Support parameterized SQL in PySpark
• is related to: SPARK-42702 Support parameterized CTE
• is related to: SPARK-44783 Test arrays as parameters
• is related to: SPARK-42924 Clarify the comment of parameterized SQL args
• links to: [Github] Pull Request #38712 (MaxGekk)
• links to: [Github] Pull Request #38864 (MaxGekk)
• links to: [Github] Pull Request #38864 (MaxGekk)