From 37b583d43116263bd4efbd025599944cc6e467eb Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Sun, 22 Jan 2023 15:43:23 +0200
Subject: [PATCH] query composer add quote column

---
 .../ORM/QueryComposer/BaseQueryComposer.php   | 20 ++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/application/Espo/ORM/QueryComposer/BaseQueryComposer.php b/application/Espo/ORM/QueryComposer/BaseQueryComposer.php
index 12834f0619..41bf55289f 100644
--- a/application/Espo/ORM/QueryComposer/BaseQueryComposer.php
+++ b/application/Espo/ORM/QueryComposer/BaseQueryComposer.php
@@ -2733,6 +2733,7 @@ abstract class BaseQueryComposer implements QueryComposer
                 $fromAlias = $this->getFromAlias($params, $entity->getEntityType());
 
                 $leftPart = $fromAlias . '.' . $this->toDb($this->sanitize($field));
+                $leftPart = $this->quoteColumn($leftPart);
             }
         }
 
@@ -3545,22 +3546,23 @@ abstract class BaseQueryComposer implements QueryComposer
             }
 
             if (strpos($attribute, '.') > 0) {
-                list($alias, $attribute) = explode('.', $attribute);
+                [$alias, $attribute] = explode('.', $attribute);
 
                 $alias = $this->sanitize($alias);
                 $column = $this->toDb($this->sanitize($attribute));
-                $left = "{$alias}.{$column}";
-            } else {
+
+                $left = $this->quoteColumn("{$alias}.{$column}");
+            }
+            else {
                 $table = $this->toDb($entity->getEntityType());
                 $column = $this->toDb($this->sanitize($attribute));
-                $left = "{$table}.{$column}";
+
+                $left = $this->quoteColumn("{$table}.{$column}");
             }
 
-            if ($isNotValue) {
-                $right = $this->convertComplexExpression($entity, $value, false, $params);
-            } else {
-                $right = $this->quote($value);
-            }
+            $right = $isNotValue ?
+                $this->convertComplexExpression($entity, $value, false, $params) :
+                $this->quote($value);
 
             $list[] = $left . " = " . $right;
         }