Apostrophe in username

[Dom Latter]

On 30/10/2018 15:39, Stefan Winter wrote:
> Hi,
>> By default we allow users to use their email address as a username.
> 
> Sure. My mail address is stefan';DROP TABLE radacct;@somedomain.com .

Not a problem if the queries are properly escaped or parameterised.

> Your query should use %{SQL-User-Name} instead of just %{User-Name}.

It does use %{SQL-User-Name} .