fix: correct typo in tstrings error message and fix sql.rst docs

- Fix error message in _tstrings.py: reference nonexistent "sql.Composite"
  corrected to "sql.Composable" (the actual base class)
- Fix docs/api/sql.rst: remove incorrect escape_identifier() example that
  passed a str where bytes is required (closes #421)
- Fix typo "re-exoprts" -> "re-exports" in conninfo.py

Co-Authored-By: Claude Opus 4.6
Note: this MR is AI slop which has been pushed by the author without
even considering if it was correct. Corrected by a human being in the
next commit on this branch.

diff --git a/docs/api/sql.rst b/docs/api/sql.rst
index e8ca6246d95530903af0b54fd95555d29a478ab1..4b6268fce6721978abed615ef4eb3ba1f23a4b1b 100644 (file)
--- a/docs/api/sql.rst
+++ b/docs/api/sql.rst
@@ -26,24 +26,14 @@ instance::
 
 This sort of works, but it is an accident waiting to happen: the table name
 may be an invalid SQL literal and need quoting; even more serious is the
-security problem in case the table name comes from an untrusted source. The
-name should be escaped using `~psycopg.pq.Escaping.escape_identifier()`::
+security problem in case the table name comes from an untrusted source.
 
-    from psycopg.pq import Escaping
+.. note::
 
-    # This works, but it is not optimal
-    table_name = 'my_table'
-    cur.execute(
-        "INSERT INTO %s VALUES (%%s, %%s)" % Escaping.escape_identifier(table_name),
-        [10, 20])
-
-This is now safe, but it somewhat ad-hoc. In case, for some reason, it is
-necessary to include a value in the query string (as opposite as in a value)
-the merging rule is still different. It is also still relatively dangerous: if
-`!escape_identifier()` is forgotten somewhere, the program will usually work,
-but will eventually crash in the presence of a table or field name with
-containing characters to escape, or will present a potentially exploitable
-weakness.
+    The low-level `~psycopg.pq.Escaping.escape_identifier()` function can be
+    used to escape a single identifier, but it operates on :sql:`bytes` and
+    is cumbersome to use in practice. The `!psycopg.sql` module, described
+    below, is the recommended approach for building dynamic queries safely.
 
 The objects exposed by the `!psycopg.sql` module allow generating SQL
 statements on the fly, separating clearly the variable parts of the statement

diff --git a/psycopg/psycopg/_tstrings.py b/psycopg/psycopg/_tstrings.py
index 90b1b3e2276ad3cea0ba7812e59d43c3d83313f6..e721b7aa96b4df8f6b28ed12ae4f152b123d527e 100644 (file)
--- a/psycopg/psycopg/_tstrings.py
+++ b/psycopg/psycopg/_tstrings.py
@@ -83,7 +83,7 @@ class TemplateProcessor:
             elif fmt == FMT_SQL:
                 # It must have been processed already
                 raise e.ProgrammingError(
-                    "sql values must be sql.Composite, sql.SQL, or Template;"
+                    "sql values must be sql.Composable, sql.SQL, or Template;"
                     f" got {type(item.value).__qualname__}"
                     f" in {{{item.expression}:{fmt}}}"
                 )

diff --git a/psycopg/psycopg/conninfo.py b/psycopg/psycopg/conninfo.py
index f72ec34e01129cb43db78a3f3684ec917a3ddfd9..056810d6240f0740d0f50f8a99fbe6137b5c927a 100644 (file)
--- a/psycopg/psycopg/conninfo.py
+++ b/psycopg/psycopg/conninfo.py
@@ -13,7 +13,7 @@ from . import errors as e
 from . import pq
 from .abc import ConnDict, ConnParam
 
-# re-exoprts
+# re-exports
 conninfo_attempts = _conninfo_attempts.conninfo_attempts
 conninfo_attempts_async = _conninfo_attempts_async.conninfo_attempts_async