Shiny textInput to sting used in SQL - r

Question

I have a textInput in a Shiny app for the user to write three character product codes separated by a comma. For example: F03, F04, F05.
The output of the textInput is used in a function calling a sql script. It will be used as a filter in the sql statement, eg
sqlfunction <- function(text){
sqlQuery(conn, stri_paste("select .... where product_code in (", text, ");"))
}
To convert the textInput to a string that I can use in the sql statement, I have used
toString(sprintf("'%s'", unlist(strsplit(input$text_input, ","))))
This works and converts the textInput to 'F03', 'F04'. 'F05' however when used in the sql only the first code, 'F03', is used in the search despite using product_code in (). The data returned is only those with a product code F03.
How do I get all three codes, if not more, written in textInput into a string to use in the sql clause?
Andrew

Answer 1

if your input is
F03, F04, F05
with whitespaces between commas and next value, the statement gives :
select .... where product_code in ('F03', ' F04', ' F05');
Note the whitespaces. Then the values 'F04' and 'F05' are not found.
What if the input is 'F03,F04,F05' ? (without spaces)

Answer 2

I'll combine the important components of the other answers and discussion into one suggested answer. Feel free to accept one of them, they had the ideas first.
As Jrm_FRL said, it is possible that whitespace around the commas is being preserved in your script, which should not match in the SQL.
toString(sQuote(unlist(strsplit("hello, world, again", ","))))
# [1] "'hello', ' world', ' again'"
### ^-- ^-- leading spaces on the strings
Some options:
If you think it is important for the user to be able to intentionally introduce whitespace around the commas (meaning: at the beginning or end of a string/pattern), then your only hope is to instruct the user to only use whitespace when intended.
Otherwise, you can use trimws:
toString(sQuote(trimws(unlist(strsplit("hello, world, again", ",")))))
# [1] "'hello', 'world', 'again'"
strsplit(..., ",") can be incorrect if the user has quotes to keep things together. You might consider using read.csv:
trimws(unlist(read.csv(text="hello, \"world, too\", again", header = FALSE, stringsAsFactors = FALSE)))
# V1 V2 V3
# "hello" "world, too" "again"
This is not perfectly compatible with option 1 above.
Second, as Tim Biegeleisen and Jrm_FRL both agreed, you are specifically prone to SQL injection here. A malformed (either accidentally or intentionally) search string from the user can at best corrupt this query's results, at worst (depending on connection permissions) corrupt or delete the data in the database. (I strongly suggest you read https://db.rstudio.com/best-practices/run-queries-safely/.)
Ways to safeguard this:
Don't manually add single-quotes around your data: if a string includes a single-quote, it will not be escaped and will cause at best a SQL error.
toString(sQuote(trimws(unlist(strsplit("hello'; drop table students; --", ",")))))
# [1] "'hello'; drop table students; --'"
### this query may delete the 'students' table
### notice that `sQuote` is not enough here, it is not escaping this correctly
Instead, use DBI::dbQuoteString. While I believe most DBMSes use the same convention of single-quotes (and your question suggests that yours does, too), it can be good practice to let the database driver determine how to deal with literal strings and those with embedded quotes.
toString(DBI::dbQuoteString(con, trimws(unlist(strsplit("hello'; drop table students; --", ",")))))
# [1] "'hello''; drop table students; --'"
### ^^ this is SQL's way of escaping an embedded single-quote
### this is now a single string, allegedly SQL-safe
Instead of including the strings into the query, use DBI::dbBind, though admittedly you'll need to include multiple binding bookmarks (often but not always ?) based on the length of your values vector.
val_str <- "hello, world, again"
val_vec <- trimws(unlist(strsplit("hello, world, again", ",")))
qmarks <- paste(rep("?", length(val_vec)), collapse = ",")
qmarks
# [1] "?,?,?"
qry <- paste("select ... where product_code in (", qmarks, ")")
out <- tryCatch({
res <- NULL
res <- DBI::dbSendStatement(con, qry)
DBI::dbBind(res, val_vec)
DBI::dbFetch(res)
}, finally = { if (!is.null(res)) suppressWarnings(DBI::dbClearResult(res)) })
The use of ? varies by DMBS, so you may need to do some research for your specific situation.
(While I used tryCatch here to "guarantee" that res will be cleared on exit, this pattern is a little more robust than doing it without. If part of the query or binding fails without the finally= part, then it could leave the connection in an imperfect state.)

Answer 3

Here is what I suspect is what you want:
text_input = "A,B,C"
in_clause <- paste0("'", unlist(strsplit(text_input, ",")), "'", collapse=",")
sql <- paste0("WHERE product_code IN (", in_clause, ")")
sql
[1] "WHERE product_code IN ('A','B','C')"
Here I am still using your combination of unlist and strsplit to generate a string vector of terms for the IN clause. But then I use paste with collapse to get the output you want.