Try our conversational search powered by Generative AI!

DDS storage does not escape column names

Found in

EPiServer.CMS.Core 9.9.0

Fixed in

EPiServer.CMS.Core 9.12.1

(Or a related package)

Created

Jul 11, 2016

Updated

Aug 26, 2016

Area

CMS Core

State

Closed, Fixed and tested


Description

Step to reproduce

1. Create a class that implements IDynamic and contains string property named "Key".

   public class DdsEntity : IDynamicData 
    { 
    public Identity Id { get; set; } 
    public string Key { get; set; } 
    }

2. To look up record with certain key, use following query:

var item = _store.Items<DdsEntity>().FirstOrDefault(x => x.Key == key);

3. When executed, the query throws this exception: "Incorrect syntax near the keyword 'Key'."

Generated SQL is as follows:

exec sp_executesql N'SELECT TOP(1) "DdsStorage".Id, "DdsStorage".Key FROM [dbo].[VW_DdsStorage] as "DdsStorage" 
WHERE ("DdsStorage".[Key] = @Param0)',N'@Param0 nvarchar(31)',@Param0=N'2fc2de51-572f-4040-a505-2b611c5974d5'

As you can see, DDS storage has escaped property name in WHERE part, but not in the SELECT p