Merge remote-tracking branch 'origin/master'

svc/queries/statement_header.go

@@ -18,11 +18,18 @@ func GetStatements(params models.StatementParams) ([]models.StatementHeader, err
 	// Parislemler []string → '1','2','3'
 	parislemFilter := "''"
 	if len(params.Parislemler) > 0 {
-		quoted := make([]string, len(params.Parislemler))
-		for i, v := range params.Parislemler {
-			quoted[i] = fmt.Sprintf("'%s'", v)
+		quoted := make([]string, 0, len(params.Parislemler))
+		for _, v := range params.Parislemler {
+			v = strings.TrimSpace(v)
+			if v == "" {
+				continue
+			}
+			// Escape tek tırnak to avoid malformed SQL when list is injected into IN (...).
+			quoted = append(quoted, fmt.Sprintf("'%s'", strings.ReplaceAll(v, "'", "''")))
+		}
+		if len(quoted) > 0 {
+			parislemFilter = strings.Join(quoted, ",")
 		}
-		parislemFilter = strings.Join(quoted, ",")
 	}
 
 	query := fmt.Sprintf(`
@@ -155,7 +162,7 @@ SELECT
 
     o.Devir_Bakiyesi,
 
-    '%s'
+    CAST(NULL AS varchar(32)) AS Parislemler
 
 FROM Opening o
 
@@ -169,7 +176,6 @@ ORDER BY
 `,
 		parislemFilter,
 		parislemFilter,
-		parislemFilter,
 	)
 
 	rows, err := db.MssqlDB.Query(query,