Q:

Do I need to worry about SQL injections when using dplyr in R to import csv into SQLite database?

I have a database in R that uses RSQLite. There is one table in this database, and I want the user to be able to import .csv files to add data to that table. If I'm using dplyr to do this, do I need to worry about 'cleaning' the data in the spreadsheet to make sure none of it is going to screw with my database? Like, for example, making sure apostrophes don't interfere with the SQL query. Does dplyr take care of this? I am not very familiar with SQL so please bear with me.

A:

You should be safe as long as you used parametrized statements in RSQLite (dplyr has nothing to do with this), i.e. the potentially dangerous data are set as separated argument and not put directly in the query text. RSQLite is going to make sure the values are properly escaped to avoid SQL injections.
The documentation provides examples of such queries, here with a delete action, but it is transposable to insertion.
rs <- dbSendStatement(mydb, 'DELETE FROM iris WHERE "Sepal.Length" < :x')

## added: bind the actual data here:
dbBind(rs, param = list(x = 4.5))

dbGetRowsAffected(rs)

