It seems that the Query Builder handles (implicitly) escaping an apostrophe (ll characters to be escaped). As a SQL statement I mask the ’ (apostrophe) with utils.stringReplace like in the following example
var query = "
SELECT
id
FROM
teaching_allotments
WHERE
course_code = ‘" + utils.stringReplace(code, "’", “‘’”) + “'”;
As a Query Builder statement, there is (seems to be) no need for masking, like the following code is sufficient. I assume it’s escaping the characters described in https://wiki.servoy.com/display/DOCS/Escape+sequences
A confirmation of my assumption would be very helpful. Thanks.
var query = datasources.db.hades.teaching_allotments.createSelect();
var ta = query.columns;
query.result
.addPk();
query.where
.add(ta.course_code.eq(code));
The QueryBuilder translates to sql using prepared statements which saves you from SQL injection attacks, see https://cheatsheetseries.owasp.org/chea … Sheet.html
So, no escaping needed (if you add quotes they will appear in the data)
Thanks for your answer, good to be sure about the escaping of QB. By the way, for debugging it would be helpful to have the right side of a WHERE clause, not only a ?
But databaseManager.getSQL(query) returns the statement with ? on the right side of the comparison. I assume because of the prepared statement there is no chance to the the real values instead of the ? Is this correct?
databaseManager.getSQL() returns the sql that would run for the current database with a question mark for each parameter.
We also have databaseManager.getSQLParameters() which returns an array of the parameter values in order of the question marks appearing in the sql.