LiteralString describes strings known to originate from literals or safe literal-preserving operations.
What It Does and Why It Matters
LiteralString describes strings known to originate from literals or safe literal-preserving operations. It is useful for the design of secure APIs, but checking a type is not a substitute for parameterized SQL statements.
Pass values separately using the database driver parameter mechanism.
Annotations guide static tools; by default they do not validate external input or change the return value at runtime.
Step-by-Step Example
Start with the complete example below. Read the inputs and predict what the final print statement will show before you run it.
from typing import LiteralString
def build_query(query_template: LiteralString) -> str:
return query_template
safe_query = build_query('SELECT name FROM products WHERE id = ?')
print(safe_query)How the Code Works
- The imports make these standard-library tools available: typing.
- The definition of build_query creates reusable behavior; its body runs only when called or instantiated as appropriate.
- The name safe_query receives the value of build_query('SELECT name FROM products WHERE id = ?'). Changing this input lets you explore a different case.
- The print calls display the results. Compare these results with the method’s documented return type and the input used.
- The annotations describe intended types for editors and checkers. They are not a replacement for validating input values when the function runs.
Expected output:
SELECT name FROM products WHERE id = ?For the demonstrated inputs, Python displays 'SELECT name FROM products WHERE id = ?'. This result follows from the operation described above; change one input at a time to understand which rule matters.
What to Notice
Pay attention to the accepted input types, the returned value and the boundary behavior. Predict what changes if you replace the example input with an empty, zero, negative or missing value, where that value is meaningful for this operation.
If the task uses a library function, inspect its documented exceptions and return type before reusing it inside a larger function.
Where You Would Use This
This helps maintain larger projects where functions and data shapes cross module boundaries. Check the code with a static analyzer, and still validate data received from files, users or remote APIs. Annotation constructs do not normally enforce types automatically at runtime.
Practice Exercise
Annotate a fixed SQL template and keep untrusted values in separate parameters.
Before running your edited example, write down the result you expect. Then test at least one valid boundary or deliberately invalid value, using appropriate exception handling where necessary.
Reference: official Python documentation for the complete API contract and version notes.
Common Beginner Mistakes
- Believing LiteralString sanitizes dynamic SQL or guarantees that a database query is injection-proof.
- Overlooking the documented condition: it is useful for the design of secure APIs, but checking a type is not a substitute for parameterized SQL statements.
Key Takeaways
- LiteralString describes strings known to originate from literals or safe literal-preserving operations.
- Annotate a fixed SQL template and keep untrusted values in separate parameters.
- Annotations guide static tools; by default they do not validate external input or change the return value at runtime.