-
Notifications
You must be signed in to change notification settings - Fork 11
Open
Description
we built filter expressions like
$searchParams = [
'returnProperties' => true,
'filter' => '(
(\'adaid\' == '.(int) $user->adaid.') AND
( \'active\')
)',
];
$result = $this->client->send(new SearchItems($userid, $searchQuery, self::COUNT_SEARCH_ITEMS, $searchParams));
for this case we need to escape user-input so we can use it in the filter query.
atm this is easy because we just have this int here. but image we would have to pass in a string value.. how should this value be escaped for the filter-expression?
IMO the SDK should provide a escaping method, so we can use whatever variable inside the expresssion without security risks
Metadata
Metadata
Assignees
Labels
No labels