Updated Query Build custom string option for where to remove make it clear the values do not get escaped. #4892
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…clear the values do not get escaped.
MGatner
approved these changes
Jun 30, 2021
michalsn
approved these changes
Jun 30, 2021
|
@mmrtonmoybd If you would like to repost your comment without deriding other developers you may. To be clear, this was not an issue with the code, but rather making sure developers knew: if you use the direct SQL bypass, you are responsible for handling SQL injections. Either way, thank you for bringing it to the team's attention. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The current version of the user guide presents some confusion making it appear that the custom string option of the
wherefunction in the Query Builder would escape the data. That was incorrect. It appears that NO escaping is done in that case.The user guide has been updated to make it very clear that user-supplied data MUST be escaped manually when using that option.