🙊 escape sql strings

apps/dashboard/src/app/(app)/[organizationId]/[projectId]/events/event-conversions-list/index.tsx

@@ -1,4 +1,5 @@
 import { Widget } from '@/components/widget';
+import { escape } from 'sqlstring';
 
 import { db, getEvents } from '@openpanel/db';
 
@@ -21,7 +22,7 @@ export default async function EventConversionsListServer({ projectId }: Props) {
   }
 
   const events = await getEvents(
-    `SELECT * FROM events WHERE project_id = '${projectId}' AND name IN (${conversions.map((c) => `'${c.name}'`).join(', ')}) ORDER BY created_at DESC LIMIT 20;`,
+    `SELECT * FROM events WHERE project_id = ${escape(projectId)} AND name IN (${conversions.map((c) => escape(c.name)).join(', ')}) ORDER BY created_at DESC LIMIT 20;`,
     {
       profile: true,
       meta: true,

apps/dashboard/src/app/(app)/[organizationId]/[projectId]/profiles/profile-last-seen/index.tsx

@@ -5,6 +5,7 @@ import {
 } from '@/components/ui/tooltip';
 import { Widget, WidgetBody, WidgetHead } from '@/components/widget';
 import { cn } from '@/utils/cn';
+import { escape } from 'sqlstring';
 
 import { chQuery } from '@openpanel/db';
 
@@ -20,7 +21,7 @@ export default async function ProfileLastSeenServer({ projectId }: Props) {
   // Days since last event from users
   // group by days
   const res = await chQuery<Row>(
-    `SELECT age('days',created_at, now()) as days, count(distinct profile_id) as count FROM events where project_id = '${projectId}' group by days order by days ASC`
+    `SELECT age('days',created_at, now()) as days, count(distinct profile_id) as count FROM events where project_id = ${escape(projectId)} group by days order by days ASC`
   );
 
   const take = 18;

apps/dashboard/src/app/(app)/[organizationId]/[projectId]/profiles/profile-top/index.tsx

@@ -4,6 +4,7 @@ import { Widget, WidgetHead } from '@/components/widget';
 import { WidgetTable } from '@/components/widget-table';
 import { getProfileName } from '@/utils/getters';
 import Link from 'next/link';
+import { escape } from 'sqlstring';
 
 import { chQuery, getProfiles } from '@openpanel/db';
 
@@ -19,7 +20,7 @@ export default async function ProfileTopServer({
   // Days since last event from users
   // group by days
   const res = await chQuery<{ profile_id: string; count: number }>(
-    `SELECT profile_id, count(*) as count from events where profile_id != '' and project_id = '${projectId}' group by profile_id order by count() DESC LIMIT 10`
+    `SELECT profile_id, count(*) as count from events where profile_id != '' and project_id = ${escape(projectId)} group by profile_id order by count() DESC LIMIT 10`
   );
   const profiles = await getProfiles({ ids: res.map((r) => r.profile_id) });
   const list = res.map((item) => {