diff --git a/src/DIRAC/TransformationSystem/DB/TransformationDB.py b/src/DIRAC/TransformationSystem/DB/TransformationDB.py index 7e1db34b3f0..f3eb27ad911 100755 --- a/src/DIRAC/TransformationSystem/DB/TransformationDB.py +++ b/src/DIRAC/TransformationSystem/DB/TransformationDB.py @@ -182,9 +182,16 @@ def addTransformation( "EventsPerTask": eventsPerTask, } + # A list of parameters that we do not want to substitute as parameters, but directly + # into the statement # I'm erring on the side of caution by using the _escapeString(body) version of the Body parameter, # but for everything else it seems reasonably safe to use the parameterised query feature - subst = ", ".join(f"%({name})s" if name != "Body" else body for name in params) + unparameterised_columns = [ + "Body", + "CreationDate", + "LastUpdate", + ] + subst = ", ".join(f"%({name})s" if name not in unparameterised_columns else params[name] for name in params) req = f"INSERT INTO Transformations ({', '.join(params)}) VALUES ({subst});"