From 5b0e4122988c76f34ae9f7e33de6da0189ddfc09 Mon Sep 17 00:00:00 2001
From: "kiloconnect[bot]" <240665456+kiloconnect[bot]@users.noreply.github.com>
Date: Tue, 9 Jun 2026 09:32:16 +0000
Subject: [PATCH] fix(admin): escape HogQL backslashes

---
 apps/web/src/routers/admin-feature-interest-router.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/apps/web/src/routers/admin-feature-interest-router.ts b/apps/web/src/routers/admin-feature-interest-router.ts
index 4078f44e8d..0cc9e861ac 100644
--- a/apps/web/src/routers/admin-feature-interest-router.ts
+++ b/apps/web/src/routers/admin-feature-interest-router.ts
@@ -42,6 +42,9 @@ const DetailInputSchema = z.object({
   offset: z.number().min(0).default(0),
 });
 
+const escapeHogQLStringLiteral = (value: string) =>
+  value.replace(/\\/g, '\\\\').replace(/'/g, "\\'");
+
 export const adminFeatureInterestRouter = createTRPCRouter({
   // Feature Interest Leaderboard
   list: adminProcedure.query(async () => {
@@ -158,9 +161,8 @@ export const adminFeatureInterestRouter = createTRPCRouter({
     // When only slug is provided (from Signups by Feature Page), search by feature_slug property
     const featureName = nameParam ?? slug;
 
-    // Escape single quotes in the feature name for the SQL query
-    const escapedValue = featureName.replace(/'/g, "\\'");
-    const escapedSlug = slug.replace(/'/g, "\\'");
+    const escapedValue = escapeHogQLStringLiteral(featureName);
+    const escapedSlug = escapeHogQLStringLiteral(slug);
 
     // Build the WHERE condition based on search type
     // Use LIKE for partial matching to capture all variations of feature names