datadict could not insert special characters

[gluneau]

added unsafe to insert query and phpcs

[codecov-io]

Current coverage is 15.09%

Merging #1803 into 17.0-dev will not change coverage

@@           17.0-dev      #1803   diff @@
==========================================
  Files           122        122           
  Lines         19713      19713           
  Methods        1081       1081           
  Messages       7539          0   -7539   
  Branches          0          0           
==========================================
  Hits           2975       2975           
  Misses        16738      16738           
  Partials          0          0           

Powered by Codecov. Last updated by 3b4bf6e...14e09e3

[johnsaigle]

The use case here doesn't match the description of the function:

This will insert a row. HTML from any field in the row will not be automatically escaped. This should only be called when we know the source of the input is trustworthy and must contain HTML.

Since this was changed to allow for entering a value of <TEST_NAME>, and this seems to be a placeholder name, it might be better to just use a different pair of delimiters around "TEST_NAME".

[gluneau]

The front end joins two tables parameter_type and parameter_type_override.

This issue arises when an item is in tables parameter_type and not parameter_type_override.

Therefore this script will try to make the entry in parameter_type_override.

Since the data already made it in parameter_type, it is safe to assume that it is wanted as well in parameter_type_override.

The issue was discovered because the safe insert had transformed < into < and could not join the table, and would try to re-insert it every time. This cause a server error because we cannot insert duplicates in parameter_type_override.

[johnsaigle]

@driusan I think @samirdas wanted you to look at this when you get some time. Basically, whether you think that the trust boundary between parameter_type and parameter_type_override is secure enough to allow for the use of unsafeinsert.

[jstirling91]

React is escaping these columns