SQL Server escape queries

Grafana MSSQL
1

Hi all,

I have the following SQL query in a table panel: “SELECT C_SITE FROM SITE WHERE FULLNAMESITE = ‘$Site’”.

With this value “l’hopital de la paie”, I get the following error :

rawSql:“SELECT C_SITE FROM SITE WHERE FULLNAMESITE = ‘l’hopital de la paie’”
response:Object
results:Object
B:Object
message:“mssql: Unclosed quotation mark after the character string ‘’.”

Is it a bug in grafana not escaping variables or is there a way around this ?

Thanks,
Ronan.

2

After digging a bit further, this could be a security issue as I have been able to inject SQL extra code altering my variable :
“l’ UNION SELECT COUNT(*) FROM SITE WHERE 1=1 OR L_FULLNAMESITE = 'hopital de la paie”

3
4

Fix wIll be included in Grafana v5.3