Mention that extract.field is used as sql string

Change-Id: Ieb32e298e8a1df3a31bf3a6e26b1aca381ef7a4f
(cherry picked from commit e79517d571ab6ab8a2e4e1a9bbd026bbb682df29)

diff --git a/lib/sqlalchemy/sql/_elements_constructors.py b/lib/sqlalchemy/sql/_elements_constructors.py
index 51d8ac3999541c5dae8826777e51a916ff55eca4..bdc0534abe2c19176c3badc40e9621b358fceab0 100644 (file)
--- a/lib/sqlalchemy/sql/_elements_constructors.py
+++ b/lib/sqlalchemy/sql/_elements_constructors.py
@@ -1159,6 +1159,9 @@ def extract(field: str, expr: _ColumnExpressionArgument[Any]) -> Extract:
 
     :param field: The field to extract.
 
+     .. warning:: This field is used as a literal SQL string.
+         **DO NOT PASS UNTRUSTED INPUT TO THIS STRING**.
+
     :param expr: A column or Python scalar expression serving as the
       right side of the ``EXTRACT`` expression.