- sql

    - Removed an obscure feature of execute() (including connection,
      engine, Session) whereby a bindparam() construct can be sent as
      a key to the params dictionary.  This usage is undocumented
      and is at the core of an issue whereby the bindparam() object
      created implicitly by a text() construct may have the same
      hash value as a string placed in the params dictionary and
      may result in an inappropriate match when computing the final
      bind parameters.   Internal checks for this condition would
      add significant latency to the critical task of parameter
      rendering, so the behavior is removed.  This is a backwards
      incompatible change for any application that may have been
      using this feature, however the feature has never been
      documented.

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/sqlalchemy/sql/compiler.py b/lib/sqlalchemy/sql/compiler.py
index 84b0ff628..5140b7f20 100644
--- a/lib/sqlalchemy/sql/compiler.py
+++ b/lib/sqlalchemy/sql/compiler.py
@@ -226,7 +226,7 @@ class DefaultCompiler(engine.Compiled):
             params = util.column_dict(params)
             pd = {}
             for bindparam, name in self.bind_names.iteritems():
-                for paramname in (bindparam, bindparam.key, bindparam.shortname, name):
+                for paramname in (bindparam.key, bindparam.shortname, name):
                     if paramname in params:
                         pd[name] = params[paramname]
                         break