GetRows with UD Field Flagged as SQL Injection in 2025.2.3

Kinetic ERP
1

Pilot is updated to 2025.2.3 and I’ve found that any instance where I’m using a GetRows method to populate a dataview and include a UD field in the WhereClause of that method I’m getting a SQL Injection error. These same calls are not having issues in the 2025.1 Live instance.

I’ve tried a variety of input formats like UDField(“MyField_c”) and [MyField_c] but none have avoided the error.

Does anyone have any tips for making these UD fields work again? I’ve put in a ticket, but wanted to check with you amazing people as well.

2

This is a known issue. PRB: 0306098 for it exist it is being fixed.

Work-around include the _UD table name in the WhereClause.

whereClause = $"Customer_UD.Larry_c='Monkey'";

It is technically #WorkingAsDesigned (it was re-designed in 2025.2) but it is clearly a mistake because it broke ALL existing code, and thankfully they agreed and are working on a fix already.

3 Likes
3

Thank you @josecgomez!

2 Likes
4

Fix should be released to CR this week. Sources tell me .4 is good to go. Tomorrow or Thursday morning.

3 Likes
5

Is there someway to hide PRBs if they’re tied to CR or something? I go to the PRB repo in Epiccare and search for this number but it doesn’t find anything.

6

That PRB repo hasn’t worked for years :joy: (at least for me)

3 Likes