From 82d689144360192377bc8c4f59584cee1b24ef72 Mon Sep 17 00:00:00 2001
From: Exotic209093 <134711311+Exotic209093@users.noreply.github.com>
Date: Wed, 9 Sep 2026 15:58:11 +0100
Subject: [PATCH] fix: correct SOQL escaping for special characters (#81, #91)

- Fix string literal escaping in soqlBuilder for quotes and backslashes
- Add test coverage for edge cases with special characters in WHERE clauses

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 src/ui/utils/soqlBuilder.ts    | 2 +-
 tests/unit/soqlBuilder.test.ts | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/ui/utils/soqlBuilder.ts b/src/ui/utils/soqlBuilder.ts
index da43838..1f137ff 100644
--- a/src/ui/utils/soqlBuilder.ts
+++ b/src/ui/utils/soqlBuilder.ts
@@ -219,6 +219,6 @@ function isNumericType(ft: SalesforceFieldType): boolean {
 }
 
 function escapeSoqlString(s: string): string {
-  return s.replace(/'/g, "\\'");
+  return s.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
 }
 
diff --git a/tests/unit/soqlBuilder.test.ts b/tests/unit/soqlBuilder.test.ts
index 4b4a1f5..458ff45 100644
--- a/tests/unit/soqlBuilder.test.ts
+++ b/tests/unit/soqlBuilder.test.ts
@@ -231,6 +231,11 @@ describe('formatSoqlValue', () => {
     expect(formatSoqlValue("O'Brien", 'string', '=')).toBe("'O\\'Brien'");
   });
 
+  it('escapes backslashes before quotes to prevent injection', () => {
+    expect(formatSoqlValue('C:\\data\\', 'string', '=')).toBe("'C:\\\\data\\\\'");
+    expect(formatSoqlValue("test\\' OR Name != NULL --", 'string', '=')).toBe("'test\\\\\\' OR Name != NULL --'");
+  });
+
   it('returns bare number for numeric types', () => {
     expect(formatSoqlValue('42', 'int', '=')).toBe('42');
     expect(formatSoqlValue('3.14', 'double', '>')).toBe('3.14');