@teleporthq/teleport-plugin-next-data-source 0.42.34 → 0.43.0

package/src/fetchers/airtable.ts

@@ -42,12 +42,42 @@ ${generateSafeJSONParseCode()}
 
 ${generateDateFormatterCode()}
 
+// Escape a string literal for Airtable formula grammar. Strings use
+// single quotes; embedded single-quote must be backslash-escaped.
+// Backslash itself also escapes.
+const escapeAirtableString = (s) => {
+  return "'" + String(s).replace(/\\\\/g, '\\\\\\\\').replace(/'/g, "\\\\'") + "'"
+}
+
+// Escape an Airtable field reference name for use inside curly braces.
+// Only close-brace and backslash are special inside the braces.
+const escapeAirtableFieldRef = (name) => {
+  return String(name).replace(/\\\\/g, '\\\\\\\\').replace(/}/g, '\\\\}')
+}
+
+const buildAirtableSearchFormula = (rawQuery, rawQueryColumns) => {
+  if (typeof rawQuery !== 'string' || rawQuery.trim() === '') return ''
+  let cols = []
+  if (rawQueryColumns) {
+    const parsed = safeJSONParse(rawQueryColumns)
+    cols = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])
+  }
+  const validCols = cols.filter((c) => typeof c === 'string' && c.length > 0)
+  if (validCols.length === 0) return ''
+  const literal = escapeAirtableString(rawQuery)
+  const parts = validCols.map(
+    (col) => 'SEARCH(' + literal + ', {' + escapeAirtableFieldRef(col) + '})'
+  )
+  return parts.length === 1 ? parts[0] : 'OR(' + parts.join(',') + ')'
+}
+
 export default async function handler(req, res) {
   try {
-    const { query, view, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset: offsetParam } = req.query
-    
+    const { query, queryColumns, view, limit, page, perPage, sortBy, sortOrder, filters, sorts, offset: offsetParam } = req.query
+
     const queryParams = new URLSearchParams()
-    
+    const formulaParts = []
+
     if (view) {
       queryParams.append('view', view)
     }
@@ -59,12 +89,12 @@ export default async function handler(req, res) {
         parsedSorts.forEach((sort, index) => {
           if (!sort.field) return
           queryParams.append(\`sort[\${index}][field]\`, sort.field)
-          queryParams.append(\`sort[\${index}][direction]\`, sort.order?.toLowerCase() === 'desc' ? 'desc' : 'asc')
+          queryParams.append(\`sort[\${index}][direction]\`, (sort.order || '').toLowerCase().startsWith('desc') ? 'desc' : 'asc')
         })
       }
     } else if (sortBy) {
       queryParams.append('sort[0][field]', sortBy)
-      queryParams.append('sort[0][direction]', sortOrder || 'asc')
+      queryParams.append('sort[0][direction]', (sortOrder || '').toLowerCase().startsWith('desc') ? 'desc' : 'asc')
     }
     
     const perPageValue = limit || perPage || 100
@@ -114,7 +144,7 @@ export default async function handler(req, res) {
         
         if (conditions.length > 0) {
           const filterFormula = conditions.length > 1 ? \`AND(\${conditions.join(',')})\` : conditions[0]
-          queryParams.append('filterByFormula', filterFormula)
+          formulaParts.push(filterFormula)
         }
       } else {
         const conditions = Object.entries(parsedFilters).map(([field, value]) => {
@@ -127,13 +157,29 @@ export default async function handler(req, res) {
             return \`{\${field}}=\${formatAirtableValue(value)}\`
           }
         })
-        
+
         const filterFormula = conditions.length > 1 ? \`AND(\${conditions.join(',')})\` : conditions[0]
         if (filterFormula) {
-          queryParams.append('filterByFormula', filterFormula)
+          formulaParts.push(filterFormula)
         }
       }
     }
+
+    // Apply the { query, queryColumns } search contract via the
+    // Airtable SEARCH() function. Search-term string literal escaping
+    // protects against single-quote injection; field-ref escaping
+    // protects against close-brace or backslash breaking out of the
+    // {field} reference.
+    const searchFormula = buildAirtableSearchFormula(query, queryColumns)
+    if (searchFormula) {
+      formulaParts.push(searchFormula)
+    }
+
+    if (formulaParts.length === 1) {
+      queryParams.append('filterByFormula', formulaParts[0])
+    } else if (formulaParts.length > 1) {
+      queryParams.append('filterByFormula', 'AND(' + formulaParts.join(',') + ')')
+    }
     
     let url = \`https://api.airtable.com/v0/${baseId}/\${encodeURIComponent('${tableName}')}\`
     if (queryParams.toString()) {

package/src/fetchers/clickhouse.ts

@@ -68,28 +68,13 @@ export default async function handler(req, res) {
     
     const conditions = []
     
-    if (query) {
-      if (queryColumns) {
-        const parsed = safeJSONParse(queryColumns)
-        const columns = Array.isArray(parsed) ? parsed : [parsed]
-        const searchConditions = columns.map(
-          (col) => \`positionCaseInsensitive(toString(\${col}), '\${query}') > 0\`
-        )
-        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
-      } else {
-        // Note: Without queryColumns, ClickHouse can't search all columns efficiently
-        // Users should provide queryColumns for optimal search performance
-        console.warn('Search query provided without queryColumns - search may not work as expected')
-      }
-    }
-    
     const formatClickHouseValue = (value) => {
       if (value === null || value === undefined) return 'NULL'
       if (typeof value === 'string') return \`'\${value.replace(/'/g, "\\\\'")}'\`
       if (typeof value === 'boolean') return value ? '1' : '0'
       return String(value)
     }
-    
+
     // Helper to sanitize identifier (prevent SQL injection in column names)
     const sanitizeIdentifier = (name) => {
       // Only allow alphanumeric and underscore
@@ -98,6 +83,27 @@ export default async function handler(req, res) {
       }
       return \`\\\`\${name}\\\`\`
     }
+
+    if (query) {
+      if (queryColumns) {
+        const parsed = safeJSONParse(queryColumns)
+        const columns = Array.isArray(parsed) ? parsed : [parsed]
+        // Escape the search term into a ClickHouse string literal so
+        // single quotes and backslashes can't break out of the literal
+        // or execute injected SQL. Column identifiers are sanitized
+        // against the identifier regex above.
+        const queryLiteral = formatClickHouseValue(String(query))
+        const searchConditions = columns.map(
+          (col) =>
+            \`positionCaseInsensitiveUTF8(toString(\${sanitizeIdentifier(col)}), \${queryLiteral}) > 0\`
+        )
+        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
+      } else {
+        // Note: Without queryColumns, ClickHouse can't search all columns efficiently
+        // Users should provide queryColumns for optimal search performance
+        console.warn('Search query provided without queryColumns - search may not work as expected')
+      }
+    }
     
     if (filters) {
       const parsedFilters = safeJSONParse(filters)
@@ -157,16 +163,16 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const orderClauses = parsedSorts.map((sort) => {
           if (!sort.field) return null
-          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          const order = (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
           return \`\${sanitizeIdentifier(sort.field)} \${order}\`
         }).filter(Boolean)
-        
+
         if (orderClauses.length > 0) {
           sql += \` ORDER BY \${orderClauses.join(', ')}\`
         }
       }
     } else if (sortBy) {
-      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${sortOrder?.toUpperCase() || 'ASC'}\`
+      sql += \` ORDER BY \${sanitizeIdentifier(sortBy)} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
     }
     
     const limitValue = limit || perPage

package/src/fetchers/csv-file.ts

@@ -131,7 +131,7 @@ const generateHandlerBody = (): string => {
             const field = labelToIdMap[sort.field] || sort.field
             const aVal = getNestedValue(a, field)
             const bVal = getNestedValue(b, field)
-            const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+            const sortOrderValue = (sort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
             
             let comparison = 0
             if (aVal === null || aVal === undefined) {
@@ -159,7 +159,7 @@ const generateHandlerBody = (): string => {
       filteredData.sort((a, b) => {
         const aVal = getNestedValue(a, field)
         const bVal = getNestedValue(b, field)
-        const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+        const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
         
         let comparison = 0
         if (aVal === null || aVal === undefined) {

package/src/fetchers/firestore.ts

@@ -150,12 +150,12 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         parsedSorts.forEach((sort) => {
           if (!sort.field) return
-          const order = sort.order?.toLowerCase() === 'desc' ? 'desc' : 'asc'
+          const order = (sort.order || '').toLowerCase().startsWith('desc') ? 'desc' : 'asc'
           queryRef = queryRef.orderBy(sort.field, order)
         })
       }
     } else if (sortBy) {
-      const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? 'desc' : 'asc'
+      const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? 'desc' : 'asc'
       queryRef = queryRef.orderBy(sortBy, sortOrderValue)
     }
     

package/src/fetchers/google-sheets.ts

@@ -328,7 +328,7 @@ export default async function handler(req, res) {
             const field = labelToIdMap[sort.field] || sort.field
             const aVal = getNestedValue(a, field)
             const bVal = getNestedValue(b, field)
-            const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+            const sortOrderValue = (sort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
             
             let comparison = 0
             if (aVal === null || aVal === undefined) {
@@ -357,7 +357,7 @@ export default async function handler(req, res) {
         const field = labelToIdMap[sortBy] || sortBy
         const aVal = getNestedValue(a, field)
         const bVal = getNestedValue(b, field)
-        const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+        const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
         
         let comparison = 0
         if (aVal === null || aVal === undefined) {

package/src/fetchers/index.ts

@@ -24,9 +24,10 @@ export {
   validateJavaScriptConfig,
 } from './javascript'
 export { generateCSVFileFetcher, generateCSVCountFetcher, validateCSVConfig } from './csv-file'
-export {
-  generateStaticCollectionFetcher,
-  generateStaticCollectionCountFetcher,
-  validateStaticCollectionConfig,
-} from './static-collection'
 export { generateGoogleSheetsFetcher, validateGoogleSheetsConfig } from './google-sheets'
+export {
+  generateTeleportFetcher,
+  generateTeleportCountFetcher,
+  validateTeleportConfig,
+} from './teleport'
+export { generateRawQueryFetcher, parseQueryTemplateVariables } from './raw-query'

package/src/fetchers/javascript.ts

@@ -134,7 +134,7 @@ export default async function handler(req, res) {
                 if (!sort.field) continue
                 const aVal = getNestedValue(a, sort.field)
                 const bVal = getNestedValue(b, sort.field)
-                const sortOrderValue = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+                const sortOrderValue = (sort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
                 
                 let comparison = 0
                 if (aVal === null || aVal === undefined) {
@@ -164,7 +164,7 @@ export default async function handler(req, res) {
         data.sort((a, b) => {
           const aVal = getNestedValue(a, sortBy)
           const bVal = getNestedValue(b, sortBy)
-          const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+          const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
           
           let comparison = 0
           if (aVal === null || aVal === undefined) {

package/src/fetchers/mariadb.ts

@@ -2,6 +2,7 @@ import {
   replaceSecretReference,
   generateDateFormatterCode,
   generateSafeJSONParseCode,
+  generateSearchEscapeHelpersCode,
 } from '../utils'
 
 interface MariaDBConfig {
@@ -26,6 +27,8 @@ export const generateMariaDBFetcher = (
 
 ${generateSafeJSONParseCode()}
 
+${generateSearchEscapeHelpersCode()}
+
 // Helper function to process filters and build conditions
 const processFilters = (filters, conditions, queryParams) => {
   if (!filters) return
@@ -121,8 +124,10 @@ export default async function handler(req, res) {
       let columns = []
       
       if (queryColumns) {
-        // Use specified columns
-        columns = safeJSONParse(queryColumns)
+        // Use specified columns. Wrap non-arrays so a single column
+        // passed as a bare string doesn't get iterated as chars.
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])
       } else {
         // Fallback: Get all columns from information_schema
         try {
@@ -140,12 +145,16 @@ export default async function handler(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map((col) => \`CAST(\\\`\${col}\\\` AS CHAR) LIKE ?\`)
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
-        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
+        const pattern = "%" + escapeLikePattern(query) + "%"
+        const searchConditions = columns.map(
+          (col) =>
+            "LOWER(CAST(\`" + sanitizeSearchIdentifier(col) + "\` AS CHAR)) LIKE LOWER(?) ESCAPE '|'"
+        )
+        columns.forEach(() => queryParams.push(pattern))
+        conditions.push("(" + searchConditions.join(" OR ") + ")")
       }
     }
-    
+
     // Apply filters using helper function
     processFilters(filters, conditions, queryParams)
     
@@ -161,16 +170,16 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const orderClauses = parsedSorts.map((sort) => {
           if (!sort.field) return null
-          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          const order = (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
           return \`\\\`\${sort.field}\\\` \${order}\`
         }).filter(Boolean)
-        
+
         if (orderClauses.length > 0) {
           sql += \` ORDER BY \${orderClauses.join(', ')}\`
         }
       }
     } else if (sortBy) {
-      sql += \` ORDER BY \\\`\${sortBy}\\\` \${sortOrder?.toUpperCase() || 'ASC'}\`
+      sql += \` ORDER BY \\\`\${sortBy}\\\` \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
     }
     
     const limitValue = limit || perPage
@@ -285,9 +294,15 @@ async function getCount(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map(col => \`CAST(\${col} AS CHAR) LIKE ?\`).join(' OR ')
-        conditions.push(\`(\${searchConditions})\`)
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
+        const pattern = "%" + escapeLikePattern(query) + "%"
+        const searchConditions = columns
+          .map(
+            (col) =>
+              "LOWER(CAST(\`" + sanitizeSearchIdentifier(col) + "\` AS CHAR)) LIKE LOWER(?) ESCAPE '|'"
+          )
+          .join(" OR ")
+        conditions.push("(" + searchConditions + ")")
+        columns.forEach(() => queryParams.push(pattern))
       }
     }
 

package/src/fetchers/mongodb.ts

@@ -222,7 +222,7 @@ export default async function handler(req, res) {
         const sortObject = {}
         parsedSorts.forEach((sort) => {
           if (sort.field) {
-            sortObject[sort.field] = sort.order?.toLowerCase() === 'desc' ? -1 : 1
+            sortObject[sort.field] = (sort.order || '').toLowerCase().startsWith('desc') ? -1 : 1
           }
         })
         if (Object.keys(sortObject).length > 0) {
@@ -230,7 +230,7 @@ export default async function handler(req, res) {
         }
       }
     } else if (sortBy) {
-      const sortOrderValue = sortOrder?.toLowerCase() === 'desc' ? -1 : 1
+      const sortOrderValue = (sortOrder || '').toLowerCase().startsWith('desc') ? -1 : 1
       cursor = cursor.sort({ [sortBy]: sortOrderValue })
     }
     

package/src/fetchers/mysql.ts

@@ -2,6 +2,7 @@ import {
   replaceSecretReference,
   generateDateFormatterCode,
   generateSafeJSONParseCode,
+  generateSearchEscapeHelpersCode,
 } from '../utils'
 
 interface MySQLConfig {
@@ -63,6 +64,8 @@ const getConnection = () => {
 
 ${generateSafeJSONParseCode()}
 
+${generateSearchEscapeHelpersCode()}
+
 // Helper function to process filters and build conditions
 const processFilters = (filters, conditions, queryParams) => {
   if (!filters) return
@@ -131,8 +134,10 @@ export default async function handler(req, res) {
       let columns = []
       
       if (queryColumns) {
-        // Use specified columns
-        columns = safeJSONParse(queryColumns)
+        // Use specified columns. Wrap non-arrays so a single column
+        // passed as a bare string doesn't get iterated as chars.
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])
       } else {
         // Fallback: Get all columns from information_schema
         try {
@@ -150,12 +155,16 @@ export default async function handler(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map((col) => \`CAST(\${mysql.escapeId(col)} AS CHAR) LIKE ?\`)
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
-        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
+        const pattern = "%" + escapeLikePattern(query) + "%"
+        const searchConditions = columns.map(
+          (col) =>
+            "LOWER(CAST(" + mysql.escapeId(sanitizeSearchIdentifier(col)) + " AS CHAR)) LIKE LOWER(?) ESCAPE '|'"
+        )
+        columns.forEach(() => queryParams.push(pattern))
+        conditions.push("(" + searchConditions.join(" OR ") + ")")
       }
     }
-    
+
     // Apply filters using helper function
     processFilters(filters, conditions, queryParams)
     
@@ -171,16 +180,16 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const orderClauses = parsedSorts.map((sort) => {
           if (!sort.field) return null
-          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          const order = (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
           return \`\${mysql.escapeId(sort.field)} \${order}\`
         }).filter(Boolean)
-        
+
         if (orderClauses.length > 0) {
           sql += \` ORDER BY \${orderClauses.join(', ')}\`
         }
       }
     } else if (sortBy) {
-      sql += \` ORDER BY \${mysql.escapeId(sortBy)} \${sortOrder?.toUpperCase() || 'ASC'}\`
+      sql += \` ORDER BY \${mysql.escapeId(sortBy)} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
     }
     
     const limitValue = limit || perPage
@@ -265,9 +274,15 @@ async function getCount(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map(col => \`CAST(\${col} AS CHAR) LIKE ?\`).join(' OR ')
-        conditions.push(\`(\${searchConditions})\`)
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
+        const pattern = "%" + escapeLikePattern(query) + "%"
+        const searchConditions = columns
+          .map(
+            (col) =>
+              "LOWER(CAST(" + mysql.escapeId(sanitizeSearchIdentifier(col)) + " AS CHAR)) LIKE LOWER(?) ESCAPE '|'"
+          )
+          .join(" OR ")
+        conditions.push("(" + searchConditions + ")")
+        columns.forEach(() => queryParams.push(pattern))
       }
     }
 

package/src/fetchers/postgresql.ts

@@ -2,6 +2,7 @@ import {
   replaceSecretReference,
   generateDateFormatterCode,
   generateSafeJSONParseCode,
+  generateSearchEscapeHelpersCode,
 } from '../utils'
 
 interface PostgreSQLConfig {
@@ -56,6 +57,8 @@ const getClient = () => {
 
 ${generateSafeJSONParseCode()}
 
+${generateSearchEscapeHelpersCode()}
+
 // Helper function to process filters and build conditions
 const processFilters = (filters, conditions, queryParams, paramIndex) => {
   if (!filters) return paramIndex
@@ -131,14 +134,16 @@ export default async function handler(req, res) {
       let columns = []
       
       if (queryColumns) {
-        // Use specified columns
-        columns = safeJSONParse(queryColumns)
+        // Use specified columns. Wrap non-arrays so that a single
+        // column passed as a bare string doesn't get iterated as chars.
+        const parsed = safeJSONParse(queryColumns)
+        columns = Array.isArray(parsed) ? parsed : (parsed ? [parsed] : [])
       } else {
         // Fallback: Get all columns from information_schema
         try {
           const schemaQuery = \`
-            SELECT column_name 
-            FROM information_schema.columns 
+            SELECT column_name
+            FROM information_schema.columns
             WHERE table_name = $1
             ${schema ? `AND table_schema = $2` : ''}
             ORDER BY ordinal_position
@@ -156,16 +161,17 @@ export default async function handler(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map((col) => {
-          const condition = \`\${col}::text ILIKE $\${paramIndex}\`
-          paramIndex++
-          return condition
-        })
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
-        conditions.push(\`(\${searchConditions.join(' OR ')})\`)
+        const pattern = '%' + escapeLikePattern(query) + '%'
+        const placeholder = '$' + paramIndex
+        paramIndex++
+        queryParams.push(pattern)
+        const searchConditions = columns.map(
+          (col) => '"' + sanitizeSearchIdentifier(col) + '"::text ILIKE ' + placeholder + " ESCAPE '|'"
+        )
+        conditions.push('(' + searchConditions.join(' OR ') + ')')
       }
     }
-    
+
     // Apply filters using helper function
     paramIndex = processFilters(filters, conditions, queryParams, paramIndex)
     
@@ -181,16 +187,16 @@ export default async function handler(req, res) {
       if (Array.isArray(parsedSorts) && parsedSorts.length > 0) {
         const orderClauses = parsedSorts.map((sort) => {
           if (!sort.field) return null
-          const order = sort.order?.toUpperCase() === 'DESC' ? 'DESC' : 'ASC'
+          const order = (sort.order || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'
           return \`\${sort.field} \${order}\`
         }).filter(Boolean)
-        
+
         if (orderClauses.length > 0) {
           sql += \` ORDER BY \${orderClauses.join(', ')}\`
         }
       }
     } else if (sortBy) {
-      sql += \` ORDER BY \${sortBy} \${sortOrder?.toUpperCase() || 'ASC'}\`
+      sql += \` ORDER BY \${sortBy} \${(sortOrder || '').toUpperCase().startsWith('DESC') ? 'DESC' : 'ASC'}\`
     }
     
     const limitValue = limit || perPage
@@ -286,9 +292,16 @@ async function getCount(req, res) {
       }
       
       if (columns.length > 0) {
-        const searchConditions = columns.map(col => \`\${col}::text ILIKE $\${paramIndex++}\`).join(' OR ')
-        conditions.push(\`(\${searchConditions})\`)
-        columns.forEach(() => queryParams.push(\`%\${query}%\`))
+        const pattern = '%' + escapeLikePattern(query) + '%'
+        const placeholder = '$' + paramIndex
+        paramIndex++
+        queryParams.push(pattern)
+        const searchConditions = columns
+          .map(
+            (col) => '"' + sanitizeSearchIdentifier(col) + '"::text ILIKE ' + placeholder + " ESCAPE '|'"
+          )
+          .join(' OR ')
+        conditions.push('(' + searchConditions + ')')
       }
     }