Compare commits

...

1 Commits

Author SHA1 Message Date
Claude Code
9235249539 docs(jinja): show a safe filter example in get_filters docstring
The get_filters docstring demonstrated building a LIKE clause by hand-escaping
the value with replace("'", "''"). That pattern is incomplete and easy to
misuse. Remove it from the example, keep the where_in-based IN example, and add
a warning against hand-escaping filter values into SQL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-08 09:55:48 -07:00

View File

@@ -354,6 +354,12 @@ class ExtraCache:
- you want to have the ability for filter inside the main query for speed
purposes
.. warning::
Do not hand-escape filter values into SQL strings (for example with
``replace("'", "''")``). Such patterns are incomplete and easy to get
wrong. Render list values through the ``where_in`` filter, and prefer
the ``IN`` operator over building literals by hand.
Usage example::
@@ -375,10 +381,6 @@ class ExtraCache:
AND
full_name IN {{ filter.get('val')|where_in }}
{%- endif -%}
{%- if filter.get('op') == 'LIKE' -%}
AND
full_name LIKE '{{ filter.get('val') | replace("'", "''") }}'
{%- endif -%}
{%- endfor -%}
UNION ALL
SELECT