Psycopg2 Throwing Syntax error over dynamically generated SQL - python-3.x

Question

So i have the following snippet where i am trying to generated a Dynamic SQL for insert, following is my payload that is passed as payload.
data = {"id": "123", "name": "dev", "description": "This is the dev Env","created_by":"me","updated_by": "me","table_name": table_name}
I am getting the following error for above mentioned payload.
LINE 1: ...updated_by, table_name) VALUES (123, dev, This is the dev En...
My Implementation:
class DMLRelationalDB:
def __init__(self):
pass;
def insert_sql(self, params):
"""
:param params:
:return:
"""
converted_dict = self.__convert_params_to_columns_and_placeholders(params)
print(converted_dict)
column_names = ", ".join(converted_dict['columns'])
placeholders = ", ".join(converted_dict['values'])
table_name = params["table_name"]
statement = f"""INSERT INTO {table_name} ({column_names}) VALUES ({placeholders})"""
print(statement)
return statement
def __convert_params_to_columns_and_placeholders(self, items_dict):
"""
:param items_dict:
:return:
"""
columns = []
values = []
for key, value in items_dict.items():
columns.append(key)
values.append(value)
return {"columns": columns, "values": values}

Answer 1

The problem is that you are trying to pass string values to your postgres DB without quoting them first. Personally I would quote all the data that will enter the database, just to make sure that it is handled correctly.
What you can do is the following:
placeholders = ", ".join([f'"{val}"' for val in converted_dict['values']])
If you have different types of data like datetimes for example the string representation will be put inside the f-string, so it would be safe.
If you have strings that contain double quotation marks you could use "dollar-quoting" to be on the safe side:
placeholders = ", ".join([f'$${val}$$' for val in converted_dict['values']])
If you think that there is a possibility that some string of yours would have two dollars after another, then put some string between the two-dollars to make it abolutely safe:
placeholders = ", ".join([f'$str${val}$str$' for val in converted_dict['values']])
The downside to this is that you increase the amount of data that is transfered and if you have lots of information, it will decrease the performance.