use sa.text()

uc-cdis · Oct 28, 2022 · dc2fa7d · dc2fa7d
1 parent fa545f9
commit dc2fa7d
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/migrations/versions/6819874e85b9_remove_deprecated_metadata.py b/migrations/versions/6819874e85b9_remove_deprecated_metadata.py
@@ -19,8 +19,8 @@
 
 
 def escape(str):
-    # escape % and single quotes for SQL statement
-    return str.replace("%", "%%").replace("'", "''")
+    # escape colon for sa.text() and single quotes for SQL statement
+    return str.replace(":", "\:").replace("'", "''")
 
 
 def upgrade():
@@ -47,7 +47,7 @@ def upgrade():
                 sql_statement = f"""UPDATE metadata
                                     SET data='{escape(json.dumps(data))}'
                                     WHERE guid='{guid}'"""
-                connection.execute(sql_statement)
+                connection.execute(sa.text(sql_statement))
         # Grab another batch of rows
         offset += limit
         query = f"SELECT guid, data FROM metadata ORDER BY guid LIMIT {limit} OFFSET {offset} "