Bug description
GIVEN a Superset dashboard with a string filter, whose charts and filters are all SQL language based such as Databricks SQL WHEN a value is passed to the filter containing an apostrophe for example "Customer" -> "'Ronald O'Donnell" THEN Superset will add an extra apostrophe, causing a string escape effectively removing the apostrophe from the original string value e.g. "SELECT * from XXX where Customer = 'Jordan O''Donnell'"
Screenshots/recordings
No response
Superset version
master / latest-dev
Python version
3.9
Node version
16
Browser
Chrome
Additional context
No response
Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
Comment From: dosubot[bot]
Hi @fazzafaz! I'm Dosu and I’m helping the superset team.
The behavior you're seeing—where an apostrophe in a filter value (like O'Donnell) is escaped as O''Donnell in the generated SQL—is standard SQL escaping and is correct for most databases. This is a security feature to prevent SQL injection and is handled by SQLAlchemy, which Superset uses for query generation.
However, Databricks SQL expects single quotes to be escaped with a backslash (O\'Donnell), not by doubling them. This mismatch is a known issue with the Databricks SQLAlchemy dialect. A recent pull request addresses this by monkeypatching a custom string escaper for Databricks in Superset. Upgrading to the latest databricks-sqlalchemy package (which requires SQLAlchemy 2.x) also resolves this issue, but the 1.x line still has the bug. You can see more details in this pull request.
For most other databases, the current escaping is correct and secure. For Databricks, consider upgrading the dialect or applying the monkeypatch from the referenced PR. Superset's filter handling is not injection-prone in the standard workflow, as it relies on SQLAlchemy's safe escaping conventions.
To reply, just mention @dosu.
How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other 
