Login fails when odbc_connect PWD= includes a plus sign about sqlalchemy

[zzzeek]

pyodbc connector would appear to have been written as:

        if 'odbc_connect' in keys:
            connectors = [util.unquote_plus(keys.pop('odbc_connect'))]

for decades. so we'd have to do something with that. likely would be very backwards incompatible for those who are working around this right now (Which you can do using an escape code for the + sign)

[CaselIT]

Could we just document that the odbc_connect requeires escaping, like user and passwords?

[zzzeek]

we could do that!

[zzzeek]

but it looks like the current implementation is really wrong, is the thing. that unquote is likely left over from when the unquoting wasnt happening elsewhere.

[gordthompson]

but it looks like the current implementation is really wrong, is the thing. that unquote is likely left over from when the unquoting wasnt happening elsewhere.

That is true. The string is now already unquoted by that point, so the unquote_plus() is superfluous. I will submit a Gerrit patch shortly.

[zzzeek]

right but....if someone is sending + sign like you are because they want a space character....

thiis would need LOTS of test cases

[sqla-tester]

Gord Thompson has proposed a fix for this issue in the main branch:

Avoid removing + from odbc_connect parameter values https://gerrit.sqlalchemy.org/c/sqlalchemy/sqlalchemy/+/5248

[gordthompson]

if someone is sending + sign like you are because they want a space character....

Then the string would have to be completely manually quoted, and the + will have already been unquoted to a space before it hit that line in connectors/pyodbc.py

sqlalchemy/lib/sqlalchemy/connectors/pyodbc.py

Line 78 in ac7d70d

connectors = [unquote_plus(keys.pop("odbc_connect"))]

[zzzeek]

We need to have test cases both for string URLs that include ?connect_args=... as well as the form that you are using. We must exhaustively test that not a single URL that worked before would have any change in behavior whatsoever.

We've yet to have any changes to URL of any kind that have not produced immediate blowback and arguments.