diff --git a/frappe/model/db_query.py b/frappe/model/db_query.py index 91e9d32164..0ad7088540 100644 --- a/frappe/model/db_query.py +++ b/frappe/model/db_query.py @@ -1121,13 +1121,18 @@ from {tables} if ORDER_GROUP_PATTERN.match(_lower): frappe.throw(_("Illegal SQL Query")) + # NEW: strip backticked identifiers so words inside table/field names + # (e.g. `tabTrade Union`) don't trigger 'union' / 'select ... from' checks + sanitized = re.sub(r"`[^`]*`", "", _lower) + subquery_indicators = { r"union", r"intersect", r"select\b.*\bfrom", } - if any(re.search(r"\b" + pattern + r"\b", _lower) for pattern in subquery_indicators): + # run the subquery checks against the sanitized string + if any(re.search(r"\b" + pattern + r"\b", sanitized) for pattern in subquery_indicators): frappe.throw(_("Cannot use sub-query here.")) blacklisted_sql_functions = {