From 907e8fd77cc60fa9c67bc927e6b1a917775c12e6 Mon Sep 17 00:00:00 2001
From: Sven Klemm <sven@timescale.com>
Date: Wed, 15 Aug 2018 11:37:30 +0200
Subject: [PATCH] fix variable escaping

---
 public/app/plugins/datasource/postgres/postgres_query.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/public/app/plugins/datasource/postgres/postgres_query.ts b/public/app/plugins/datasource/postgres/postgres_query.ts
index 7e49a8a149f..b239ddbfb05 100644
--- a/public/app/plugins/datasource/postgres/postgres_query.ts
+++ b/public/app/plugins/datasource/postgres/postgres_query.ts
@@ -48,7 +48,11 @@ export default class PostgresQuery {
   }
 
   quoteLiteral(value) {
-    return "'" + value.replace("'", "''") + "'";
+    return "'" + this.escapeLiteral(value) + "'";
+  }
+
+  escapeLiteral(value) {
+    return value.replace("'", "''");
   }
 
   hasTimeGroup() {
@@ -62,7 +66,7 @@ export default class PostgresQuery {
   interpolateQueryStr(value, variable, defaultFormatFn) {
     // if no multi or include all do not regexEscape
     if (!variable.multi && !variable.includeAll) {
-      return value;
+      return this.escapeLiteral(value);
     }
 
     if (typeof value === 'string') {