Open-Source Databases · apache

datafusion-sqlparser-rs

Apache DataFusion SQL Parser is a Rust library that parses SQL statements into an abstract syntax tree (AST), supporting ANSI/ISO SQL and multiple dialects. It is designed for extensibility and used by several query engines and data tools.

Talk to DEV.co Discuss Implementation

Source: GitHub — github.com/apache/datafusion-sqlparser-rs

3.4k

GitHub stars

742

Forks

Rust

Primary language

Apache-2.0

License (OSI-approved)

Key facts

Objective fields from the source. Values we can't verify are shown as “Unknown” rather than guessed.

Field	Value
Repository	apache/datafusion-sqlparser-rs
Owner	apache
Primary language	Rust
License	Apache-2.0 — OSI-approved
Stars	3.4k
Forks	742
Open issues	257
Latest release	Unknown
Last updated	2026-07-03
Source	https://github.com/apache/datafusion-sqlparser-rs

What datafusion-sqlparser-rs is

A hand-written recursive descent parser with Pratt parsing for expressions, providing syntax-only parsing without semantic validation. Supports multiple SQL dialects, preserves syntax round-trip fidelity, and includes optional features for serialization, AST visitation, and stack overflow protection.

Quickstart

Get the datafusion-sqlparser-rs source

Clone the repository and explore it locally.

terminalbash

1git clone https://github.com/apache/datafusion-sqlparser-rs.git2cd datafusion-sqlparser-rs3# follow the project's README for install & configuration

Need it deployed, integrated, or customized instead? DEV.co ships production installs.

Best use cases

SQL Query Engine Foundation

Use as the parsing layer for custom SQL query engines, data processing frameworks, or analytics systems that need dialect-flexible SQL ingestion without semantic database constraints.

SQL Analysis and Transformation Tools

Build tools that analyze, validate, rewrite, or optimize SQL statements programmatically, leveraging syntax round-trip preservation to maintain normalized output while applying custom logic.

Vendor-Specific SQL Dialects

Extend with custom dialects for proprietary or niche SQL variants; the modular design supports pluggable dialect implementations without forking the core parser.

Implementation considerations

Integrate as a library dependency in Cargo.toml; optional features (serde, visitor, recursive-protection) must be explicitly enabled based on use case.
The parser is syntax-only; build your own semantic layer (type inference, column resolution, function signatures) for production systems.
Dialect selection is explicit at parse time; ensure your application supplies the correct dialect object (GenericDialect, AnsiDialect, or custom) based on source SQL origin.
Stack overflow protection is enabled by default via the recursive crate; verify performance characteristics in your deployment environment.
AST round-trip to string works but normalizes whitespace and comments; design output formatting accordingly for user-facing or diff-sensitive applications.

When to avoid it — and what to weigh

Semantic Validation Required — If you need type checking, schema validation, or detection of duplicate column names and other semantic errors, this parser alone is insufficient; build validation on top or use a full query engine.
Direct Query Execution — This is a parser, not an executor. Do not expect it to run, optimize, or plan queries; use it with a query engine like DataFusion, DuckDB, or PostgreSQL for end-to-end SQL processing.
Production Security Barrier — Do not rely solely on this parser to enforce SQL injection protection or security policies; implement additional input validation, parameterization, and access control at the application layer.
Bleeding-Edge SQL Standard Compliance — Support is primarily SQL-92 with selective newer features; if you need full SQL:2016+ coverage or obscure dialect-specific syntax, verify compatibility experimentally before committing.

License & commercial use

Apache License 2.0 (Apache-2.0). Permissive OSI-approved open-source license allowing commercial use, modification, and distribution with ASF copyright notice and NOTICE file retention.

Apache-2.0 is a permissive license that permits unrestricted commercial use, bundling in proprietary products, and closed-source derivatives, provided the Apache license text and NOTICE file are retained. No special permission or fee required. Verify NOTICE file inclusion in your distribution.

DEV.co evaluation signals

Editorial assessment — not user reviews. Directional, with an explicit confidence level.

Signal	Assessment
Maintenance	Active
Documentation	Adequate
License clarity	Clear
Deployment complexity	Low
DEV.co fit	Strong
Assessment confidence	High

Security considerations

Parser is syntax-only and does not validate SQL semantics, meaning malformed or unexpected statements are not rejected at parse time. No injection protection is built in; use parameterized queries or input validation at the application layer. No cryptographic operations or sensitive data handling in scope. Review your query execution engine's security posture separately. Recursive-protection feature mitigates stack overflow from deeply nested expressions.

Alternatives to consider

sqlx (Rust)

Compile-time checked SQL with database integration; heavier than a standalone parser but provides type safety and direct query execution for PostgreSQL, MySQL, SQLite.

nom/lalrpop (Rust Parser Generators)

Lower-level parsing toolkits; more flexible for custom grammars but require more code and offer less pre-built SQL support than sqlparser-rs.

PostgreSQL libpq / MySQL libmysqlclient (C/C++ parsers)

Native database parsers with full semantic validation and dialect accuracy; harder to embed in Rust, vendor-specific, heavier runtime cost.

Software development agency

Build on datafusion-sqlparser-rs with DEV.co software developers

DataFusion SQL Parser is a production-grade foundation for parsing and analyzing SQL. Whether you're building a query engine, data transformation tool, or SQL linter, our engineers can help you integrate and extend it.

Talk to DEV.co

Related open-source tools

Surfaced by semantic similarity across the DEV.co open-source index.

datafusion sql-parser datafusion-ballista

Related on DEV.co

Explore the category and the services that help you build with it.

Open-Source Databases API Development AI / Application Development DevOps / Infrastructure Talk to DEV.co

datafusion-sqlparser-rs FAQ

Can I use this to execute SQL queries?

No. This is a parser only. It converts SQL text to an AST. To execute queries, pair it with a query engine like DataFusion, DuckDB, Polars, or PostgreSQL.

Does it prevent SQL injection?

No. It is a syntax parser, not a security boundary. Use parameterized queries, input validation, and access control in your application to prevent injection attacks.

Which SQL dialects does it support?

Primarily ANSI/ISO SQL-92, with selective syntax from newer standards and dialect-specific extensions (e.g., T-SQL, PostgreSQL, BigQuery). Verify your specific dialect experimentally before use.

How do I create a custom SQL dialect?

Implement a custom Dialect struct and override parsing rules as needed. See docs/custom_sql_parser.md and the codebase for examples. Contributions back are encouraged.

Software development & web development with DEV.co

DEV.co is a software development agency delivering custom software development services to companies building on open source. Our software developers and web developers design, integrate, and ship production systems — spanning web development, APIs, AI, data, and cloud. If datafusion-sqlparser-rs is part of your open-source databases roadmap, our team can implement, customize, migrate, and maintain it.

Ready to Build a SQL-Powered Tool?

Talk to DEV.co Schedule a Consultation