{"record":{"id":"96f05291dcc42e86","repo":"Budibase/budibase","slug":"variable-name-has-characters-that-are-not-allowed","errorCode":null,"errorMessage":"Variable name has characters that are not allowed","messagePattern":"Variable name has characters that are not allowed","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/pro/src/sdk/environmentVariables/environmentVariables.ts","lineNumber":57,"sourceCode":"  if (!license.features.includes(Feature.ENVIRONMENT_VARIABLES)) {\n    throw new Error(\n      \"User does not have access to environment variables feature.\"\n    )\n  }\n  const doc = await environmentVariables.get()\n  doc.variables = cb(doc.variables)\n  await environmentVariables.update(doc)\n}\n\nexport async function update(varName: string, value: EnvironmentVariableValue) {\n  const checkName = isValid(varName)\n  if (checkName) {\n    await changeValues(values => {\n      values[varName] = value\n      return values\n    })\n  } else {\n    throw new Error(\"Variable name has characters that are not allowed\")\n  }\n}\n\nexport async function remove(varName: string) {\n  await changeValues(values => {\n    delete values[varName]\n    return values\n  })\n}\n\nexport function isValid(str: string) {\n  return /^[a-zA-Z0-9-_]+$/.test(str)\n}\n","sourceCodeStart":39,"sourceCodeEnd":71,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/pro/src/sdk/environmentVariables/environmentVariables.ts#L39-L71","documentation":"Environment variable names are validated against an allowed character pattern before being written. update(varName, value, checkName) applies the value via changeValues only when the name passes validation; otherwise it throws this error without touching stored variables. It protects the variable map from keys that would break templating or storage.","triggerScenarios":"Calling update() with a varName containing characters outside the allowed set (e.g. spaces, hyphens, or other non word characters depending on the validation regex), with checkName defaulting to true.","commonSituations":"User-entered variable names from a form or API payload that were not sanitized; importing variable definitions from a .env file where names contain dashes; renaming conventions differing between environments.","solutions":["Rename the variable to use only allowed characters (typically alphanumeric plus underscores).","Sanitize/normalize the incoming name (trim, replace invalid characters with underscores) before calling update().","Validate names at the API/UI boundary with the same pattern used by the SDK so users get early feedback.","Pass checkName=false only if you have separately guaranteed the name is valid — not as a way to bypass validation."],"exampleFix":"// before\nawait environmentVariables.update(\"api-key-value\", \"secret\")\n// after\nconst safeName = \"api-key-value\".replace(/[^A-Za-z0-9_]/g, \"_\")\nawait environmentVariables.update(safeName, \"secret\")","handlingStrategy":"validation","validationCode":"const ALLOWED = /^[A-Za-z0-9_]+$/\nif (!ALLOWED.test(varName)) {\n  throw new ValidationError(\"Variable name may only contain letters, numbers and underscores\")\n}","typeGuard":null,"tryCatchPattern":"try {\n  await environmentVariables.update(varName, value)\n} catch (err) {\n  if (err.message.includes(\"characters that are not allowed\")) {\n    // surface validation error to user\n  } else throw err\n}","preventionTips":["Sanitize variable names at the form/API boundary before calling update","Document the allowed naming pattern to users","Normalize names (trim, replace invalid chars with _) automatically"],"tags":["validation","environment-variables","naming"],"backgroundTag":"invalid-variable-name","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}