https://netsuiteprofessionals.com logo
Join Slack
Powered by
when using SuiteQL, is there a way to properly san...
# suitescript
e
when using SuiteQL, is there a way to properly sanitize query strings, ideally for ALL potentially problematic/unsafe characters, such as single quotes like O'Reilly. i know that making it '', helps that but is there is a way to sanitize ALL potentially problematic/unsafe characters?
e
you mean in the WHERE clause? Are you using parameters?
e
yes WHERE blank IN ('O'Reilly')
e
Are you using parameters, or building the query string manually?
e
parameters
e
using * as the param
still poses an issue?
e
whaddaya mean by params
im doing: WHERE blank IN ('${param}')
e
question mark instead
e
and then where is the param?
e
depends - share code?
e
im using runsuiteql
e
message has been deleted
so, if you pass the query as IN (?) perhaps and then set the parameters option, you should be good to go
e
gotcha, thanks!!
e
var oreilly = “O’Reilly”; or ’O\‘Reilly’; then q.params = [oreilly];
ok
e
but im passing an array - so the params needs an array or the string which would have gone there?
e
oh. array for the IN … so we’re back to square one
how about outputting the array as strings, that should work
e
'a', 'b', 'c'? or ['a', 'b', 'c']? cuz without params i do as strings
e
ok, so if you know the length of the array, you can output like so: WHERE blah blah blah IN (?, ?, ?, ?, ?) by simply printing ?, for the length of the array Then pass the array to the query call
will that work? idea of parameters is to avoid sql injection, etc
e
works, but a crazy way to do it. do you know for sure that this protects from ALL problems like single quotes and stuff?
e
nope! try it. break it. 🙂
m
WHERE blank IN ('${params.map(a => '?').join(",")}')
e
thanks, @michoel that’s it… I think that is what he is doing now, right?
e
Copy code
('${params.map(a => '?').join(",")}')
why the quotes in the beginning and end? wont that mess up the param?
m
yeah sorry it's 3 am here
e
i would think so yea
e
the ? should be a variable, not a sting of '?'
e
haha go to sleep michoel
m
i wish
e
the output is ? but the map function looks correct
try it in plain old console - the result should look as we described it earlier
WHERE blah blah blah IN (?, ?, ?, ?, ?)
e
but the param variables need to all be legit strings, not 'o'reilly'
e
Michoel was just describing how to get the WHERE clause to print properly, then you pass the array to the “params” parameter/option. the array contains strings.
SQL then understands how to read ’em.
e
Copy code
.runSuiteQL({
					query: `SELECT blank FROM blank
                		WHERE LOWER(blank) IN (?,?) OR LOWER(blank) IN (?,?)`,
                    params: ["o'<mailto:brain@gmail.com|brain@gmail.com>", '<mailto:jj@g.com|jj@g.com>', "o'<mailto:brain@gmail.com|brain@gmail.com>", '<mailto:jj@g.com|jj@g.com>']
				})
works, tx!
e
😉
5 Views
Open in Slack
PreviousNext
Powered by