@budibase/backend-core 2.33.2 → 2.33.3

package/dist/src/sql/sql.js

@@ -90,6 +90,20 @@ function isSqs(table) {
     return (table.sourceType === types_1.TableSourceType.INTERNAL ||
         table.sourceId === types_1.INTERNAL_TABLE_SOURCE_ID);
 }
+function escapeQuotes(value, quoteChar = '"') {
+    return value.replace(new RegExp(quoteChar, "g"), `${quoteChar}${quoteChar}`);
+}
+function wrap(value, quoteChar = '"') {
+    return `${quoteChar}${escapeQuotes(value, quoteChar)}${quoteChar}`;
+}
+function stringifyArray(value, quoteStyle = '"') {
+    for (let i in value) {
+        if (typeof value[i] === "string") {
+            value[i] = wrap(value[i], quoteStyle);
+        }
+    }
+    return `[${value.join(",")}]`;
+}
 const allowEmptyRelationships = {
     [types_1.BasicOperator.EQUAL]: false,
     [types_1.BasicOperator.NOT_EQUAL]: true,
@@ -131,28 +145,24 @@ class InternalBuilder {
     get table() {
         return this.query.meta.table;
     }
+    get knexClient() {
+        return this.knex.client;
+    }
     getFieldSchema(key) {
         const { column } = this.splitter.run(key);
         return this.table.schema[column];
     }
+    supportsILike() {
+        return !(this.client === types_1.SqlClient.ORACLE || this.client === types_1.SqlClient.SQL_LITE);
+    }
     quoteChars() {
-        switch (this.client) {
-            case types_1.SqlClient.ORACLE:
-            case types_1.SqlClient.POSTGRES:
-                return ['"', '"'];
-            case types_1.SqlClient.MS_SQL:
-                return ["[", "]"];
-            case types_1.SqlClient.MARIADB:
-            case types_1.SqlClient.MY_SQL:
-            case types_1.SqlClient.SQL_LITE:
-                return ["`", "`"];
-        }
+        const wrapped = this.knexClient.wrapIdentifier("foo", {});
+        return [wrapped[0], wrapped[wrapped.length - 1]];
     }
-    // Takes a string like foo and returns a quoted string like [foo] for SQL Server
-    // and "foo" for Postgres.
+    // Takes a string like foo and returns a quoted string like [foo] for SQL
+    // Server and "foo" for Postgres.
     quote(str) {
-        const [start, end] = this.quoteChars();
-        return `${start}${str}${end}`;
+        return this.knexClient.wrapIdentifier(str, {});
     }
     isQuoted(key) {
         const [start, end] = this.quoteChars();
@@ -167,6 +177,27 @@ class InternalBuilder {
         }
         return key.map(part => this.quote(part)).join(".");
     }
+    quotedValue(value) {
+        const formatter = this.knexClient.formatter(this.knexClient.queryBuilder());
+        return formatter.wrap(value, false);
+    }
+    rawQuotedValue(value) {
+        return this.knex.raw(this.quotedValue(value));
+    }
+    // Unfortuantely we cannot rely on knex's identifier escaping because it trims
+    // the identifier string before escaping it, which breaks cases for us where
+    // columns that start or end with a space aren't referenced correctly anymore.
+    //
+    // So whenever you're using an identifier binding in knex, e.g. knex.raw("??
+    // as ?", ["foo", "bar"]), you need to make sure you call this:
+    //
+    //   knex.raw("?? as ?", [this.quotedIdentifier("foo"), "bar"])
+    //
+    // Issue we filed against knex about this:
+    //   https://github.com/knex/knex/issues/6143
+    rawQuotedIdentifier(key) {
+        return this.knex.raw(this.quotedIdentifier(key));
+    }
     // Turns an identifier like a.b.c or `a`.`b`.`c` into ["a", "b", "c"]
     splitIdentifier(key) {
         const [start, end] = this.quoteChars();
@@ -206,7 +237,7 @@ class InternalBuilder {
         const alias = this.getTableName(endpoint.entityId);
         const schema = meta.table.schema;
         if (!this.isFullSelectStatementRequired()) {
-            return [this.knex.raw(`${this.quote(alias)}.*`)];
+            return [this.knex.raw("??", [`${alias}.*`])];
         }
         // get just the fields for this table
         return resource.fields
@@ -225,17 +256,28 @@ class InternalBuilder {
             .map(({ table, column, field }) => {
             const columnSchema = schema[column];
             if (this.SPECIAL_SELECT_CASES.POSTGRES_MONEY(columnSchema)) {
-                return this.knex.raw(`${this.quotedIdentifier([table, column].join("."))}::money::numeric as ${this.quote(field)}`);
+                // TODO: figure out how to express this safely without string
+                // interpolation.
+                return this.knex.raw(`??::money::numeric as "${field}"`, [
+                    this.rawQuotedIdentifier([table, column].join(".")),
+                    field,
+                ]);
             }
             if (this.SPECIAL_SELECT_CASES.MSSQL_DATES(columnSchema)) {
                 // Time gets returned as timestamp from mssql, not matching the expected
                 // HH:mm format
-                return this.knex.raw(`CONVERT(varchar, ${field}, 108) as "${field}"`);
+                // TODO: figure out how to express this safely without string
+                // interpolation.
+                return this.knex.raw(`CONVERT(varchar, ??, 108) as "${field}"`, [
+                    this.rawQuotedIdentifier(field),
+                ]);
+            }
+            if (table) {
+                return this.rawQuotedIdentifier(`${table}.${column}`);
+            }
+            else {
+                return this.rawQuotedIdentifier(field);
             }
-            const quoted = table
-                ? `${this.quote(table)}.${this.quote(column)}`
-                : this.quote(field);
-            return this.knex.raw(quoted);
         });
     }
     // OracleDB can't use character-large-objects (CLOBs) in WHERE clauses,
@@ -248,7 +290,7 @@ class InternalBuilder {
         const parts = this.splitIdentifier(field);
         const col = parts.pop();
         const schema = this.table.schema[col];
-        let identifier = this.quotedIdentifier(field);
+        let identifier = this.rawQuotedIdentifier(field);
         if (schema.type === types_1.FieldType.STRING ||
             schema.type === types_1.FieldType.LONGFORM ||
             schema.type === types_1.FieldType.BB_REFERENCE_SINGLE ||
@@ -256,10 +298,13 @@ class InternalBuilder {
             schema.type === types_1.FieldType.OPTIONS ||
             schema.type === types_1.FieldType.BARCODEQR) {
             if (opts === null || opts === void 0 ? void 0 : opts.forSelect) {
-                identifier = `to_char(${identifier}) as ${this.quotedIdentifier(col)}`;
+                identifier = this.knex.raw("to_char(??) as ??", [
+                    identifier,
+                    this.rawQuotedIdentifier(col),
+                ]);
             }
             else {
-                identifier = `to_char(${identifier})`;
+                identifier = this.knex.raw("to_char(??)", [identifier]);
             }
         }
         return identifier;
@@ -367,7 +412,6 @@ class InternalBuilder {
         return query.andWhere(`${document}.fieldName`, "=", relationship.column);
     }
     addRelationshipForFilter(query, allowEmptyRelationships, filterKey, whereCb) {
-        const mainKnex = this.knex;
         const { relationships, endpoint, tableAliases: aliases } = this.query;
         const tableName = endpoint.entityId;
         const fromAlias = (aliases === null || aliases === void 0 ? void 0 : aliases[tableName]) || tableName;
@@ -384,8 +428,8 @@ class InternalBuilder {
             if ((matchesTableName || matchesRelationName) &&
                 relationship.to &&
                 relationship.tableName) {
-                const joinTable = mainKnex
-                    .select(mainKnex.raw(1))
+                const joinTable = this.knex
+                    .select(this.knex.raw(1))
                     .from({ [toAlias]: relatedTableName });
                 let subQuery = joinTable.clone();
                 const manyToMany = (0, utils_1.validateManyToMany)(relationship);
@@ -408,7 +452,7 @@ class InternalBuilder {
                         this.on(`${toAlias}.${manyToMany.toPrimary}`, "=", `${throughAlias}.${manyToMany.to}`);
                     })
                         // check the document in the junction table points to the main table
-                        .where(`${throughAlias}.${manyToMany.from}`, "=", mainKnex.raw(this.quotedIdentifier(`${fromAlias}.${manyToMany.fromPrimary}`)));
+                        .where(`${throughAlias}.${manyToMany.from}`, "=", this.rawQuotedIdentifier(`${fromAlias}.${manyToMany.fromPrimary}`));
                     // in SQS the same junction table is used for different many-to-many relationships between the
                     // two same tables, this is needed to avoid rows ending up in all columns
                     if (this.client === types_1.SqlClient.SQL_LITE) {
@@ -427,7 +471,7 @@ class InternalBuilder {
                     const toKey = `${toAlias}.${relationship.to}`;
                     const foreignKey = `${fromAlias}.${relationship.from}`;
                     // "join" to the main table, making sure the ID matches that of the main
-                    subQuery = subQuery.where(toKey, "=", mainKnex.raw(this.quotedIdentifier(foreignKey)));
+                    subQuery = subQuery.where(toKey, "=", this.rawQuotedIdentifier(foreignKey));
                     query = query.where(q => {
                         q.whereExists(whereCb(updatedKey, subQuery.clone()));
                         if (allowEmptyRelationships) {
@@ -448,7 +492,7 @@ class InternalBuilder {
         filters = this.parseFilters(Object.assign({}, filters));
         const aliases = this.query.tableAliases;
         // if all or specified in filters, then everything is an or
-        const allOr = filters.allOr;
+        const shouldOr = filters.allOr;
         const isSqlite = this.client === types_1.SqlClient.SQL_LITE;
         const tableName = isSqlite ? this.table._id : this.table.name;
         function getTableAlias(name) {
@@ -479,7 +523,7 @@ class InternalBuilder {
                     query = fn(query, alias ? `${alias}.${updatedKey}` : updatedKey, value);
                 }
                 else if (shouldProcessRelationship) {
-                    if (allOr) {
+                    if (shouldOr) {
                         query = query.or;
                     }
                     query = builder.addRelationshipForFilter(query, allowEmptyRelationships[operation], updatedKey, (updatedKey, q) => {
@@ -489,71 +533,90 @@ class InternalBuilder {
             }
         }
         const like = (q, key, value) => {
-            const fuzzyOr = filters === null || filters === void 0 ? void 0 : filters.fuzzyOr;
-            const fnc = fuzzyOr || allOr ? "orWhere" : "where";
-            // postgres supports ilike, nothing else does
-            if (this.client === types_1.SqlClient.POSTGRES) {
-                return q[fnc](key, "ilike", `%${value}%`);
+            if ((filters === null || filters === void 0 ? void 0 : filters.fuzzyOr) || shouldOr) {
+                q = q.or;
             }
-            else {
-                const rawFnc = `${fnc}Raw`;
-                // @ts-ignore
-                return q[rawFnc](`LOWER(${this.quotedIdentifier(key)}) LIKE ?`, [
+            if (this.client === types_1.SqlClient.ORACLE ||
+                this.client === types_1.SqlClient.SQL_LITE) {
+                return q.whereRaw(`LOWER(??) LIKE ?`, [
+                    this.rawQuotedIdentifier(key),
                     `%${value.toLowerCase()}%`,
                 ]);
             }
+            return q.whereILike(
+            // @ts-expect-error knex types are wrong, raw is fine here
+            this.rawQuotedIdentifier(key), this.knex.raw("?", [`%${value}%`]));
         };
         const contains = (mode, any = false) => {
-            const rawFnc = allOr ? "orWhereRaw" : "whereRaw";
-            const not = mode === (filters === null || filters === void 0 ? void 0 : filters.notContains) ? "NOT " : "";
-            function stringifyArray(value, quoteStyle = '"') {
-                for (let i in value) {
-                    if (typeof value[i] === "string") {
-                        value[i] = `${quoteStyle}${value[i]}${quoteStyle}`;
-                    }
+            function addModifiers(q) {
+                if (shouldOr || mode === (filters === null || filters === void 0 ? void 0 : filters.containsAny)) {
+                    q = q.or;
+                }
+                if (mode === (filters === null || filters === void 0 ? void 0 : filters.notContains)) {
+                    q = q.not;
                 }
-                return `[${value.join(",")}]`;
+                return q;
             }
             if (this.client === types_1.SqlClient.POSTGRES) {
                 iterate(mode, types_1.ArrayOperator.CONTAINS, (q, key, value) => {
-                    const wrap = any ? "" : "'";
-                    const op = any ? "\\?| array" : "@>";
-                    const fieldNames = key.split(/\./g);
-                    const table = fieldNames[0];
-                    const col = fieldNames[1];
-                    return q[rawFnc](`${not}COALESCE("${table}"."${col}"::jsonb ${op} ${wrap}${stringifyArray(value, any ? "'" : '"')}${wrap}, FALSE)`);
+                    q = addModifiers(q);
+                    if (any) {
+                        return q.whereRaw(`COALESCE(??::jsonb \\?| array??, FALSE)`, [
+                            this.rawQuotedIdentifier(key),
+                            this.knex.raw(stringifyArray(value, "'")),
+                        ]);
+                    }
+                    else {
+                        return q.whereRaw(`COALESCE(??::jsonb @> '??', FALSE)`, [
+                            this.rawQuotedIdentifier(key),
+                            this.knex.raw(stringifyArray(value)),
+                        ]);
+                    }
                 });
             }
             else if (this.client === types_1.SqlClient.MY_SQL ||
                 this.client === types_1.SqlClient.MARIADB) {
-                const jsonFnc = any ? "JSON_OVERLAPS" : "JSON_CONTAINS";
                 iterate(mode, types_1.ArrayOperator.CONTAINS, (q, key, value) => {
-                    return q[rawFnc](`${not}COALESCE(${jsonFnc}(${key}, '${stringifyArray(value)}'), FALSE)`);
+                    return addModifiers(q).whereRaw(`COALESCE(?(??, ?), FALSE)`, [
+                        this.knex.raw(any ? "JSON_OVERLAPS" : "JSON_CONTAINS"),
+                        this.rawQuotedIdentifier(key),
+                        this.knex.raw(wrap(stringifyArray(value))),
+                    ]);
                 });
             }
             else {
-                const andOr = mode === (filters === null || filters === void 0 ? void 0 : filters.containsAny) ? " OR " : " AND ";
                 iterate(mode, types_1.ArrayOperator.CONTAINS, (q, key, value) => {
-                    let statement = "";
-                    const identifier = this.quotedIdentifier(key);
-                    for (let i in value) {
-                        if (typeof value[i] === "string") {
-                            value[i] = `%"${value[i].toLowerCase()}"%`;
-                        }
-                        else {
-                            value[i] = `%${value[i]}%`;
-                        }
-                        statement += `${statement ? andOr : ""}COALESCE(LOWER(${identifier}), '') LIKE ?`;
-                    }
-                    if (statement === "") {
+                    if (value.length === 0) {
                         return q;
                     }
-                    if (not) {
-                        return q[rawFnc](`(NOT (${statement}) OR ${identifier} IS NULL)`, value);
-                    }
-                    else {
-                        return q[rawFnc](statement, value);
-                    }
+                    q = q.where(subQuery => {
+                        if (mode === (filters === null || filters === void 0 ? void 0 : filters.notContains)) {
+                            subQuery = subQuery.not;
+                        }
+                        subQuery = subQuery.where(subSubQuery => {
+                            for (const elem of value) {
+                                if (mode === (filters === null || filters === void 0 ? void 0 : filters.containsAny)) {
+                                    subSubQuery = subSubQuery.or;
+                                }
+                                else {
+                                    subSubQuery = subSubQuery.and;
+                                }
+                                const lower = typeof elem === "string" ? `"${elem.toLowerCase()}"` : elem;
+                                subSubQuery = subSubQuery.whereLike(
+                                // @ts-expect-error knex types are wrong, raw is fine here
+                                this.knex.raw(`COALESCE(LOWER(??), '')`, [
+                                    this.rawQuotedIdentifier(key),
+                                ]), `%${lower}%`);
+                            }
+                        });
+                        if (mode === (filters === null || filters === void 0 ? void 0 : filters.notContains)) {
+                            subQuery = subQuery.or.whereNull(
+                            // @ts-expect-error knex types are wrong, raw is fine here
+                            this.rawQuotedIdentifier(key));
+                        }
+                        return subQuery;
+                    });
+                    return q;
                 });
             }
         };
@@ -574,44 +637,41 @@ class InternalBuilder {
             });
         }
         if (filters.oneOf) {
-            const fnc = allOr ? "orWhereIn" : "whereIn";
             iterate(filters.oneOf, types_1.ArrayOperator.ONE_OF, (q, key, array) => {
+                if (shouldOr) {
+                    q = q.or;
+                }
                 if (this.client === types_1.SqlClient.ORACLE) {
+                    // @ts-ignore
                     key = this.convertClobs(key);
-                    array = Array.isArray(array) ? array : [array];
-                    const binding = new Array(array.length).fill("?").join(",");
-                    return q.whereRaw(`${key} IN (${binding})`, array);
-                }
-                else {
-                    return q[fnc](key, Array.isArray(array) ? array : [array]);
                 }
+                return q.whereIn(key, Array.isArray(array) ? array : [array]);
             }, (q, key, array) => {
-                if (this.client === types_1.SqlClient.ORACLE) {
-                    const keyStr = `(${key.map(k => this.convertClobs(k)).join(",")})`;
-                    const binding = `(${array
-                        .map((a) => `(${new Array(a.length).fill("?").join(",")})`)
-                        .join(",")})`;
-                    return q.whereRaw(`${keyStr} IN ${binding}`, array.flat());
+                if (shouldOr) {
+                    q = q.or;
                 }
-                else {
-                    return q[fnc](key, Array.isArray(array) ? array : [array]);
+                if (this.client === types_1.SqlClient.ORACLE) {
+                    // @ts-ignore
+                    key = key.map(k => this.convertClobs(k));
                 }
+                return q.whereIn(key, Array.isArray(array) ? array : [array]);
             });
         }
         if (filters.string) {
             iterate(filters.string, types_1.BasicOperator.STRING, (q, key, value) => {
-                const fnc = allOr ? "orWhere" : "where";
-                // postgres supports ilike, nothing else does
-                if (this.client === types_1.SqlClient.POSTGRES) {
-                    return q[fnc](key, "ilike", `${value}%`);
+                if (shouldOr) {
+                    q = q.or;
                 }
-                else {
-                    const rawFnc = `${fnc}Raw`;
-                    // @ts-ignore
-                    return q[rawFnc](`LOWER(${this.quotedIdentifier(key)}) LIKE ?`, [
+                if (this.client === types_1.SqlClient.ORACLE ||
+                    this.client === types_1.SqlClient.SQL_LITE) {
+                    return q.whereRaw(`LOWER(??) LIKE ?`, [
+                        this.rawQuotedIdentifier(key),
                         `${value.toLowerCase()}%`,
                     ]);
                 }
+                else {
+                    return q.whereILike(key, `${value}%`);
+                }
             });
         }
         if (filters.fuzzy) {
@@ -632,61 +692,58 @@ class InternalBuilder {
                 }
                 const lowValid = (0, utils_1.isValidFilter)(value.low), highValid = (0, utils_1.isValidFilter)(value.high);
                 const schema = this.getFieldSchema(key);
+                let rawKey = key;
+                let high = value.high;
+                let low = value.low;
                 if (this.client === types_1.SqlClient.ORACLE) {
-                    // @ts-ignore
-                    key = this.knex.raw(this.convertClobs(key));
+                    rawKey = this.convertClobs(key);
+                }
+                else if (this.client === types_1.SqlClient.SQL_LITE &&
+                    (schema === null || schema === void 0 ? void 0 : schema.type) === types_1.FieldType.BIGINT) {
+                    rawKey = this.knex.raw("CAST(?? AS INTEGER)", [
+                        this.rawQuotedIdentifier(key),
+                    ]);
+                    high = this.knex.raw("CAST(? AS INTEGER)", [value.high]);
+                    low = this.knex.raw("CAST(? AS INTEGER)", [value.low]);
+                }
+                if (shouldOr) {
+                    q = q.or;
                 }
                 if (lowValid && highValid) {
-                    if ((schema === null || schema === void 0 ? void 0 : schema.type) === types_1.FieldType.BIGINT &&
-                        this.client === types_1.SqlClient.SQL_LITE) {
-                        return q.whereRaw(`CAST(${key} AS INTEGER) BETWEEN CAST(? AS INTEGER) AND CAST(? AS INTEGER)`, [value.low, value.high]);
-                    }
-                    else {
-                        const fnc = allOr ? "orWhereBetween" : "whereBetween";
-                        return q[fnc](key, [value.low, value.high]);
-                    }
+                    // @ts-expect-error knex types are wrong, raw is fine here
+                    return q.whereBetween(rawKey, [low, high]);
                 }
                 else if (lowValid) {
-                    if ((schema === null || schema === void 0 ? void 0 : schema.type) === types_1.FieldType.BIGINT &&
-                        this.client === types_1.SqlClient.SQL_LITE) {
-                        return q.whereRaw(`CAST(${key} AS INTEGER) >= CAST(? AS INTEGER)`, [
-                            value.low,
-                        ]);
-                    }
-                    else {
-                        const fnc = allOr ? "orWhere" : "where";
-                        return q[fnc](key, ">=", value.low);
-                    }
+                    // @ts-expect-error knex types are wrong, raw is fine here
+                    return q.where(rawKey, ">=", low);
                 }
                 else if (highValid) {
-                    if ((schema === null || schema === void 0 ? void 0 : schema.type) === types_1.FieldType.BIGINT &&
-                        this.client === types_1.SqlClient.SQL_LITE) {
-                        return q.whereRaw(`CAST(${key} AS INTEGER) <= CAST(? AS INTEGER)`, [
-                            value.high,
-                        ]);
-                    }
-                    else {
-                        const fnc = allOr ? "orWhere" : "where";
-                        return q[fnc](key, "<=", value.high);
-                    }
+                    // @ts-expect-error knex types are wrong, raw is fine here
+                    return q.where(rawKey, "<=", high);
                 }
                 return q;
             });
         }
         if (filters.equal) {
             iterate(filters.equal, types_1.BasicOperator.EQUAL, (q, key, value) => {
-                const fnc = allOr ? "orWhereRaw" : "whereRaw";
+                if (shouldOr) {
+                    q = q.or;
+                }
                 if (this.client === types_1.SqlClient.MS_SQL) {
-                    return q[fnc](`CASE WHEN ${this.quotedIdentifier(key)} = ? THEN 1 ELSE 0 END = 1`, [value]);
+                    return q.whereRaw(`CASE WHEN ?? = ? THEN 1 ELSE 0 END = 1`, [
+                        this.rawQuotedIdentifier(key),
+                        value,
+                    ]);
                 }
                 else if (this.client === types_1.SqlClient.ORACLE) {
                     const identifier = this.convertClobs(key);
-                    return q[fnc](`(${identifier} IS NOT NULL AND ${identifier} = ?)`, [
-                        value,
-                    ]);
+                    return q.where(subq => 
+                    // @ts-expect-error knex types are wrong, raw is fine here
+                    subq.whereNotNull(identifier).andWhere(identifier, value));
                 }
                 else {
-                    return q[fnc](`COALESCE(${this.quotedIdentifier(key)} = ?, FALSE)`, [
+                    return q.whereRaw(`COALESCE(?? = ?, FALSE)`, [
+                        this.rawQuotedIdentifier(key),
                         value,
                     ]);
                 }
@@ -694,16 +751,28 @@ class InternalBuilder {
         }
         if (filters.notEqual) {
             iterate(filters.notEqual, types_1.BasicOperator.NOT_EQUAL, (q, key, value) => {
-                const fnc = allOr ? "orWhereRaw" : "whereRaw";
+                if (shouldOr) {
+                    q = q.or;
+                }
                 if (this.client === types_1.SqlClient.MS_SQL) {
-                    return q[fnc](`CASE WHEN ${this.quotedIdentifier(key)} = ? THEN 1 ELSE 0 END = 0`, [value]);
+                    return q.whereRaw(`CASE WHEN ?? = ? THEN 1 ELSE 0 END = 0`, [
+                        this.rawQuotedIdentifier(key),
+                        value,
+                    ]);
                 }
                 else if (this.client === types_1.SqlClient.ORACLE) {
                     const identifier = this.convertClobs(key);
-                    return q[fnc](`(${identifier} IS NOT NULL AND ${identifier} != ?) OR ${identifier} IS NULL`, [value]);
+                    return (q
+                        .where(subq => subq.not
+                        // @ts-expect-error knex types are wrong, raw is fine here
+                        .whereNull(identifier)
+                        .and.where(identifier, "!=", value))
+                        // @ts-expect-error knex types are wrong, raw is fine here
+                        .or.whereNull(identifier));
                 }
                 else {
-                    return q[fnc](`COALESCE(${this.quotedIdentifier(key)} != ?, TRUE)`, [
+                    return q.whereRaw(`COALESCE(?? != ?, TRUE)`, [
+                        this.rawQuotedIdentifier(key),
                         value,
                     ]);
                 }
@@ -711,14 +780,18 @@ class InternalBuilder {
         }
         if (filters.empty) {
             iterate(filters.empty, types_1.BasicOperator.EMPTY, (q, key) => {
-                const fnc = allOr ? "orWhereNull" : "whereNull";
-                return q[fnc](key);
+                if (shouldOr) {
+                    q = q.or;
+                }
+                return q.whereNull(key);
             });
         }
         if (filters.notEmpty) {
             iterate(filters.notEmpty, types_1.BasicOperator.NOT_EMPTY, (q, key) => {
-                const fnc = allOr ? "orWhereNotNull" : "whereNotNull";
-                return q[fnc](key);
+                if (shouldOr) {
+                    q = q.or;
+                }
+                return q.whereNotNull(key);
             });
         }
         if (filters.contains) {
@@ -791,9 +864,7 @@ class InternalBuilder {
             if (this.client === types_1.SqlClient.ORACLE) {
                 const groupByFields = qualifiedFields.map(field => this.convertClobs(field));
                 const selectFields = qualifiedFields.map(field => this.convertClobs(field, { forSelect: true }));
-                query = query
-                    .groupByRaw(groupByFields.join(", "))
-                    .select(this.knex.raw(selectFields.join(", ")));
+                query = query.groupBy(groupByFields).select(selectFields);
             }
             else {
                 query = query.groupBy(qualifiedFields).select(qualifiedFields);
@@ -805,7 +876,10 @@ class InternalBuilder {
                 if ("distinct" in aggregation && aggregation.distinct) {
                     if (this.client === types_1.SqlClient.ORACLE) {
                         const field = this.convertClobs(`${tableName}.${aggregation.field}`);
-                        query = query.select(this.knex.raw(`COUNT(DISTINCT ${field}) as ${this.quotedIdentifier(aggregation.name)}`));
+                        query = query.select(this.knex.raw(`COUNT(DISTINCT ??) as ??`, [
+                            field,
+                            aggregation.name,
+                        ]));
                     }
                     else {
                         query = query.countDistinct(`${tableName}.${aggregation.field} as ${aggregation.name}`);
@@ -864,7 +938,11 @@ class InternalBuilder {
                 else {
                     let composite = `${aliased}.${key}`;
                     if (this.client === types_1.SqlClient.ORACLE) {
-                        query = query.orderByRaw(`${this.convertClobs(composite)} ${direction} nulls ${nulls}`);
+                        query = query.orderByRaw(`?? ?? nulls ??`, [
+                            this.convertClobs(composite),
+                            this.knex.raw(direction),
+                            this.knex.raw(nulls),
+                        ]);
                     }
                     else {
                         query = query.orderBy(composite, direction, nulls);
@@ -889,18 +967,21 @@ class InternalBuilder {
     }
     buildJsonField(field) {
         const parts = field.split(".");
-        let tableField, unaliased;
+        let unaliased;
+        let tableField;
         if (parts.length > 1) {
             const alias = parts.shift();
             unaliased = parts.join(".");
-            tableField = `${this.quote(alias)}.${this.quote(unaliased)}`;
+            tableField = `${alias}.${unaliased}`;
         }
         else {
             unaliased = parts.join(".");
-            tableField = this.quote(unaliased);
+            tableField = unaliased;
         }
         const separator = this.client === types_1.SqlClient.ORACLE ? " VALUE " : ",";
-        return `'${unaliased}'${separator}${tableField}`;
+        return this.knex
+            .raw(`?${separator}??`, [unaliased, this.rawQuotedIdentifier(tableField)])
+            .toString();
     }
     maxFunctionParameters() {
         // functions like say json_build_object() in SQL have a limit as to how many can be performed
@@ -969,11 +1050,11 @@ class InternalBuilder {
                 });
             }
             // add the correlation to the overall query
-            subQuery = subQuery.where(correlatedTo, "=", knex.raw(this.quotedIdentifier(correlatedFrom)));
+            subQuery = subQuery.where(correlatedTo, "=", this.rawQuotedIdentifier(correlatedFrom));
             const standardWrap = (select) => {
                 subQuery = subQuery.select(`${toAlias}.*`).limit(getRelationshipLimit());
                 // @ts-ignore - the from alias syntax isn't in Knex typing
-                return knex.select(knex.raw(select)).from({
+                return knex.select(select).from({
                     [toAlias]: subQuery,
                 });
             };
@@ -982,10 +1063,10 @@ class InternalBuilder {
                 case types_1.SqlClient.SQL_LITE:
                     // need to check the junction table document is to the right column, this is just for SQS
                     subQuery = this.addJoinFieldCheck(subQuery, relationship);
-                    wrapperQuery = standardWrap(`json_group_array(json_object(${fieldList}))`);
+                    wrapperQuery = standardWrap(this.knex.raw(`json_group_array(json_object(${fieldList}))`));
                     break;
                 case types_1.SqlClient.POSTGRES:
-                    wrapperQuery = standardWrap(`json_agg(json_build_object(${fieldList}))`);
+                    wrapperQuery = standardWrap(this.knex.raw(`json_agg(json_build_object(${fieldList}))`));
                     break;
                 case types_1.SqlClient.MARIADB:
                     // can't use the standard wrap due to correlated sub-query limitations in MariaDB
@@ -993,18 +1074,20 @@ class InternalBuilder {
                     break;
                 case types_1.SqlClient.MY_SQL:
                 case types_1.SqlClient.ORACLE:
-                    wrapperQuery = standardWrap(`json_arrayagg(json_object(${fieldList}))`);
+                    wrapperQuery = standardWrap(this.knex.raw(`json_arrayagg(json_object(${fieldList}))`));
                     break;
-                case types_1.SqlClient.MS_SQL:
-                    wrapperQuery = knex.raw(`(SELECT ${this.quote(toAlias)} = (${knex
+                case types_1.SqlClient.MS_SQL: {
+                    const comparatorQuery = knex
                         .select(`${fromAlias}.*`)
                         // @ts-ignore - from alias syntax not TS supported
                         .from({
                         [fromAlias]: subQuery
                             .select(`${toAlias}.*`)
                             .limit(getRelationshipLimit()),
-                    })} FOR JSON PATH))`);
+                    });
+                    wrapperQuery = knex.raw(`(SELECT ?? = (${comparatorQuery} FOR JSON PATH))`, [this.rawQuotedIdentifier(toAlias)]);
                     break;
+                }
                 default:
                     throw new Error(`JSON relationships not implement for ${sqlClient}`);
             }