Skip to content

Use of double quotes

What is new - 8.1

In previous versions, a filter value containing one or more single quotes was placed inside a set of double quotes. This is no longer the case in this version, and a single escape quote is used instead.

Previously

SELECT "INVENTORY"."Item_ID", "INVENTORY"."Description" FROM "OrderEntry201"."dbo"."INVENTORY" "INVENTORY" WHERE "INVENTORY"."Description"=N"Famous Bridges I've Known - Photos"

Now

SELECT "INVENTORY"."Item_ID", "INVENTORY"."Description" FROM "OrderEntry201"."dbo"."INVENTORY" "INVENTORY" WHERE "INVENTORY"."Description"=N'Famous Bridges I''ve Known - Photos'

Notes

  • DataFlex Reports has no check for SQL Injection with filter values. The OCX expects that you, as a developer, check the validity of a filter value.