How to DROP TABLE with python odbc on SQL Server?

Question

I am using the ODBC Driver 17 for SQL Server and pyodbc. The following code does not work.

cursor.execute("""DROP TABLE IF EXISTS ?""", "table_name")

What is the problem?

Answer 1

One possibility might be to use an anonymous code block that employs the QUOTENAME function to ensure that the string you pass is treated as a complete table name:

# this table name could be problematic if QUOTENAME wasn't used
tbl_name = "]; TRUNCATE TABLE Customer; --"

sql = """\
SET NOCOUNT ON;
DECLARE @drop NVARCHAR(max);
SET @drop = 'DROP TABLE IF EXISTS ' + QUOTENAME(?);
EXEC sp_executesql @drop;
"""
crsr.execute(sql, tbl_name)