Hey everyone,
I’ve been wrestling with the DBConnector action in Studio for a bit now. The goal is straightforward: look up a customer record by email address stored in our PostgreSQL instance. We’ve got the connection profile set up and tested successfully in the admin UI, so I know the creds are good.
The issue pops up when I try to construct the SQL query inside the action configuration. I’m passing a Studio variable {{customerEmail}} into the WHERE clause. Here’s the query string I’m using:
SELECT * FROM customers WHERE email = '{{customerEmail}}'
When I test this in the Studio debugger, it throws a 500 Internal Server Error with the message “Invalid SQL Syntax”. If I hardcode an email address like test@example.com directly into the query string instead of using the variable, it works perfectly fine.
I’ve tried escaping the quotes, removing them, and even using parameterized queries if the UI allows (which I’m not entirely sure it does for this specific action). The error log doesn’t give much more detail than that generic syntax error.
Has anyone run into this with the DBConnector? Is there a specific way to inject variables into the SQL string that I’m missing? Or is this a known limitation with how Studio handles dynamic SQL injection prevention?