I noticed different behavior for escaping special characters in query text mode and graphical mode.
If i have a variable defined in query editor, special characters are sanitized correctly. But after switching to text mode editor, special characters from variable like dots and slash are not sanitized.
Grafana version: 5.4.0
Tested also on Grafana 6, where the behavior was same.