1. Add curly braces to table names
2. Determine what to do with operators supplied by a developer/user

Currently there's no validation performed on the supplied operators, which could be anything. Perhaps establishing a whiltelist would be best. See Condition.php ( \Drupal\Core\Entity\Query\Sql\Condition )

https://api.drupal.org/api/drupal/core%21lib%21Drupal%21Core%21Database%... ( \Drupal\Core\Database\Query\Condition )

Comments

imclean created an issue. See original summary.

imclean’s picture

imclean commented
Issue summary: View changes
imclean’s picture

imclean commented

Add curly braces and ignore condition if the operator contains suspect characters.

  • imclean committed b5abc24 on 8.x-1.x 
    Issue #3007763: Refine the generated query
imclean’s picture

imclean commented
Status: Active » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.