function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Andy Rouse 7Andy Rouse 7 

Potential Bug Report - Error: ORA-01424 when using Dynamic SOQL

I've got a dynamic SOQL query on a search page in Visualforce. One of the inputs is a string field that allows the user to search for records with a particular name. Oddly, particular input strings have produced the following ORA Error:

"common.exception.SfdcSqlException: ORA-01424: missing or illegal character following the escape character"

These strings work fine: "Example" "O'Jones" "O'Keefe" (I was testing names with an inverted comma in them)
This string doesn't: "An'dy" (I was testing my name with an inverted comma randomly inserted"

Does anybody know why the inverted comma would only break the query in certain circumstances? I've used the "EscapeSingleQuotes" method.

Here is a simplified version of the code, in case that helps:
public with sharing class SFBugRecreation {

	public Contact con;
	public string strSearchKeyword {get;set;}
	public string sortDirection {get;set;}
	
	public list<Services__c> lstSearchResult{
    	get;
    	set;
    } 
    	    
    // Standard controller constructor.
    public SFBugRecreation(ApexPages.StandardController pController) {
        con = (Contact) pController.getRecord(); 
    }
    
   //Clear previous search result, button handler
    public PageReference ClearResult()
    {
        strSearchKeyword='';
        lstSearchResult = null;
        return null;
    }
    
    //Search records. Invoked from button click or actionfunction on VF.
    public PageReference doSearch()
    {
        lstSearchResult = new list<Services__c>();
        
		string keywordSearch = '';
        if(strSearchKeyword != null && strSearchKeyword != ''){
        	string strSrcKeyword = string.escapeSingleQuotes('%' + strSearchKeyword.replaceAll('\\*','') + '%');
        	keywordSearch = 'Name like :strSrcKeyword';
        }
        
        string queryStart = 'Select Name from Services__c where ';
    	string queryEnd = keywordSearch+' order by Name ASC LIMIT 200';
        
        lstSearchResult = database.query(queryStart+queryEnd);
        
        return null;
    }

}
<apex:page standardController="Contact" extensions="SFBugRecreation">
	<apex:form >
		<apex:pageblock >
			<apex:inputtext value="{!strSearchKeyword}"/>
			<apex:commandButton value="Search" action="{!doSearch}" status="searchWait" rerender="pbtSearchResult"/>
			<apex:commandButton value="Clear" action="{!ClearResult}" status="searchWait" />
			<apex:actionStatus id="searchWait" startText="Please wait.." />
			
			<apex:outputpanel layout="none" id="pbtSearchResult">
				<apex:pageBlockTable value="{!lstSearchResult}" var="a"  >
					<apex:column headerValue="Service">
			        	<apex:outputField value="{!a.Name}"/> 
					</apex:column>  
				</apex:pageBlockTable>
			</apex:outputpanel>
	</apex:pageblock>
	
	</apex:form>
</apex:page>
I tried opening a case with Salesforce Support, saying it was a bug report (we don't have developer support, so I explicitly stated that I only wanted confirmation that it's a bug), but they closed the case without even looking at it.

Andy

 
Best Answer chosen by Andy Rouse 7
Andy Rouse 7Andy Rouse 7
It looks like the "escapeSingleQuotes" method is actually the thing causing the issue. In attempting to reduce the chances of SOQL injection, I've run afoul of this Known Issue:

https://success.salesforce.com/issues_view?id=a1p30000000T3OLAA0

I've registed as affected by the bug. If anybody else manages to replicate, please also register as affected?

With thanks,
Andy