Skip to content

fix(postgrest): quote column names in the insert and upsert columns parameter - #1448

Merged
jan-tennert merged 1 commit into
supabase:masterfrom
AndroidPoet:fix/postgrest-quote-columns
Nov 1, 2026
Merged

jan-tennert merged 1 commit into
supabase:masterfrom
AndroidPoet:fix/postgrest-quote-columns

Conversation

@AndroidPoet

Copy link
Copy Markdown
Contributor

What

insert and upsert with a JsonArray body send the keys of the rows as the columns query parameter, joined without quotes. PostgREST only accepts unquoted names made of letters, digits, _, $ and spaces, and it trims surrounding spaces (pIdentifier in src/library/PostgREST/ApiRequest/QueryParams.hs). A table with a column like price (usd) or a.b gets a PGRST100 parse error on insert and upsert, and a column with leading or trailing spaces is matched against the trimmed name.

supabase-js, supabase-swift and supabase-flutter quote every name here, so the same table works from those clients.

Fix

Wrap each column name in double quotes in both places that build columns. Quoted names are matched exactly, so plain names like data resolve to the same column as before.

Tests

  • testInsertValues and testUpsertValues now expect "data".
  • testInsertQuotesColumnNames and testUpsertQuotesColumnNames send price (usd) and a.b.

The 4 tests fail without the fix. All 198 Postgrest JVM tests pass with it, and detekt is clean.

No public API change.

@jan-tennert jan-tennert left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jan-tennert
jan-tennert merged commit 4d56507 into supabase:master Nov 1, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants