【Python】t-string 深掘り — PEP 750 の制約と f-string との違いを実測

from string.templatelib import Template

name = "World"
print(t"Hello {name}!")

# 実行結果（Python 3.14.7）
# Template(strings=('Hello ', ''), interpolations=(Interpolation('World', 'name', None, ''),))

from string.templatelib import Template

name = "World"
template = t"Hello {name}!"
print("strings:", template.strings)
print("values:", template.values)
print("interpolations:", template.interpolations)
print("list():", list(template))

a, b = "A", "B"
twice = t"{a}{b}"
print("consecutive strings:", twice.strings)
print("list() skips empty:", list(twice))
print("zip(strings[1:], values):", list(zip(twice.strings[1:], twice.values)))

# 実行結果
# strings: ('Hello ', '!')
# values: ('World',)
# interpolations: (Interpolation('World', 'name', None, ''),)
# list(): ['Hello ', Interpolation('World', 'name', None, ''), '!']
# consecutive strings: ('', '', '')
# list() skips empty: [Interpolation('A', 'a', None, ''), Interpolation('B', 'b', None, '')]
# zip(strings[1:], values): [('', 'A'), ('', 'B')]

from string.templatelib import convert

pi = 3.14159
print("interpolation:", t"{pi:.2f}".interpolations[0])
print("raw value:", repr(t"{pi:.2f}".values[0]))
print("f-string:", f"{pi:.2f}")
print("conversion attr:", t"{pi!r}".interpolations[0])
print("value is not converted:", repr(t"{pi!r}".values[0]))
print("convert(pi, 'r'):", convert(pi, "r"))
print("convert(pi, None):", convert(pi, None))
print("debug spec:", t"{pi=}".strings, t"{pi=}".interpolations)

# 実行結果
# interpolation: Interpolation(3.14159, 'pi', None, '.2f')
# raw value: 3.14159
# f-string: 3.14
# conversion attr: Interpolation(3.14159, 'pi', 'r', '')
# value is not converted: 3.14159
# convert(pi, 'r'): 3.14159
# convert(pi, None): 3.14159
# debug spec: ('pi=', '') (Interpolation(3.14159, 'pi', 'r', ''),)

import logging

x = 42
template = t"x is {x}"
print("str(t):", str(template))
print("f == t:", f"x is {x}" == template)
print("t == same source:", t"a{x}" == t"a{x}")
print("set of 2 equal templates:", len({t"a{x}", t"a{x}"}))
print("'x is ' in t:", "x is " in template)
print("t + t:", (t"a " + t"b{x}").strings, (t"a " + t"b{x}").values)

try:
    t"a" + "b"
except TypeError as e:
    print("t + str:", type(e).__name__, e)

try:
    len(template)
except TypeError as e:
    print("len(t):", type(e).__name__, e)

try:
    template.format()
except AttributeError as e:
    print("t.format():", type(e).__name__, e)

logging.basicConfig(level=logging.INFO, format="%(levelname)s %(message)s")
logging.info(t"user={x}")

# 実行結果
# str(t): Template(strings=('x is ', ''), interpolations=(Interpolation(42, 'x', None, ''),))
# f == t: False
# t == same source: False
# set of 2 equal templates: 2
# 'x is ' in t: True
# t + t: ('a b', '') (42,)
# t + str: TypeError can only concatenate string.templatelib.Template (not "str") to string.templatelib.Template
# len(t): TypeError object of type 'string.templatelib.Template' has no len()
# t.format(): AttributeError 'string.templatelib.Template' object has no attribute 'format'
# INFO Template(strings=('user=', ''), interpolations=(Interpolation(42, 'x', None, ''),))

import sqlite3

def sql(template, /):
    """静的な断片とプレースホルダを分けて返す。値は必ずバインドに回す。"""
    parts = []
    params = []

    for item in template:
        if isinstance(item, str):
            parts.append(item)
        else:
            parts.append("?")
            params.append(item.value)

    return "".join(parts), params

def fresh():
    con = sqlite3.connect(":memory:")
    con.execute("CREATE TABLE users (name TEXT, role TEXT)")
    con.execute("INSERT INTO users VALUES ('yuki', 'admin')")
    return con

evil = "x'; DROP TABLE users; --"

con = fresh()
con.executescript(f"SELECT name FROM users WHERE name = '{evil}'")
try:
    con.execute("SELECT count(*) FROM users").fetchall()
    print("f-string:", "users は無事")
except sqlite3.OperationalError as e:
    print("f-string:", type(e).__name__, e)

con = fresh()
query, params = sql(t"SELECT name FROM users WHERE name = {evil}")
print("t-string:", query, params)
print("結果:", con.execute(query, params).fetchall())
print("users:", con.execute("SELECT count(*) FROM users").fetchall())

try:
    fresh().execute(t"SELECT name FROM users WHERE role = {'admin'}")
except TypeError as e:
    print("sqlite3 に Template を直渡し:", type(e).__name__, e)

# 実行結果
# f-string: OperationalError no such table: users
# t-string: SELECT name FROM users WHERE name = ? ["x'; DROP TABLE users; --"]
# 結果: []
# users: [(1,)]
# sqlite3 に Template を直渡し: TypeError execute() argument 1 must be str, not string.templatelib.Template

import html
from string.templatelib import convert

TAG_CHARS = "<>"


def render(template, /):
    out = []

    for item in template:
        if isinstance(item, str):
            out.append(item)
            continue

        value = convert(item.value, item.conversion)
        out.append(html.escape(format(value, item.format_spec), quote=True))

    return "".join(out)


user_input = ""
print("render の長さ:", len(render(t"{user_input}")), "/ f-string の長さ:", len(f"{user_input}"))
print("render にタグ文字が残る:", any(c in render(t"{user_input}") for c in TAG_CHARS))
print("f-string にタグ文字が残る:", any(c in f"{user_input}" for c in TAG_CHARS))
print("format_spec:", render(t"{3.14159:.2f} / {7:04d}"))

# 実行結果
# render の長さ: 51 / f-string の長さ: 29
# render にタグ文字が残る: False
# f-string にタグ文字が残る: True
# format_spec: 3.14 / 0007

$ python 06_syntax.py
  File "06_syntax.py", line 2
    print("t-string:", t"value is {value}")
                        ^^^^^^^^^^^^^^^^^^
SyntaxError: invalid syntax

$ ./python.exe 06_syntax.py
t-string: Template(strings=('value is ', ''), interpolations=(Interpolation(42, 'value', None, ''),))