{"record":{"id":"f05c3027f2cfaf69","repo":"microsoft/semantic-kernel","slug":"invalid-identifier-with-quotes-name","errorCode":null,"errorMessage":"Invalid identifier with quotes: {name}","messagePattern":"Invalid identifier with quotes: (.+?)","errorType":"exception","errorClass":"VectorStoreOperationException","httpStatus":null,"severity":"error","filePath":"python/semantic_kernel/connectors/oracle.py","lineNumber":490,"sourceCode":"            )\n\n        return None\n\n    @override\n    def _serialize_dicts_to_store_models(self, records: Sequence[dict[str, Any]], **kwargs: Any) -> Sequence[Any]:\n        \"\"\"Serialize a list of dicts of the data to the store model. Pass the records through without modification.\"\"\"\n        return records\n\n    def _validate_identifiers(self, name: str) -> None:\n        \"\"\"Validate Oracle identifier to disallow embedded double quotes.\n\n        Since quoted identifiers are not allowed, any double quote is invalid.\n        \"\"\"\n        if not name:\n            raise VectorStoreOperationException(\"Identifier cannot be empty\")\n\n        if '\"' in name:\n            raise VectorStoreOperationException(f\"Invalid identifier with quotes: {name}\")\n\n    def _build_check_table_exists_query(self) -> tuple[str, dict[str, str]]:\n        \"\"\"Build SQL + bind variables for checking table existence.\n\n        - If schema is provided, query ALL_TABLES.\n        - If no schema, query USER_TABLES.\n        \"\"\"\n        if self.db_schema:\n            sql = \"\"\"\n                SELECT 1\n                FROM   all_tables\n                WHERE  owner = :owner\n                AND    table_name = :tbl\n            \"\"\"\n            bind_vars = {\n                \"owner\": self.db_schema,\n                \"tbl\": self.collection_name,\n            }","sourceCodeStart":472,"sourceCodeEnd":508,"githubUrl":"https://github.com/microsoft/semantic-kernel/blob/c028a0c7dc4f0814cdcbaba9d998f187a41197bf/python/semantic_kernel/connectors/oracle.py#L472-L508","documentation":"Thrown by OracleCollection._validate_identifiers when an identifier contains a double-quote character. The connector builds quoted identifiers (\"name\") in its SQL, so an embedded double quote would break the quoting boundary and enable SQL injection; such names are rejected outright.","triggerScenarios":"collection_name, db_schema, or a field name/storage_name containing a '\"' character; typically from unsanitized user-controlled input passed as a table or column name.","commonSituations":"User-supplied table/column names not sanitized; copy-paste artifact including a quote; attempting to use Oracle quoted-identifier semantics through the name string.","solutions":["Strip or reject double quotes from collection, schema, and field names before construction","Use plain alphanumeric identifiers with underscores (standard Oracle naming)","Never pass untrusted user input directly as an identifier - map it to a safe name first","Validate identifiers with a regex like ^[A-Za-z_][A-Za-z0-9_]*$ before passing them in"],"exampleFix":"# before\ntable = request.args['table']  # e.g. 'foo\" -- drop'\nOracleCollection(record_type=MyModel, collection_name=table)  # raises 1514\n\n# after - sanitize\nimport re\nsafe = re.sub(r'[^A-Za-z0-9_]', '', request.args['table']) or 'default'\nOracleCollection(record_type=MyModel, collection_name=safe)","handlingStrategy":"validation","validationCode":"import re\n\ndef sanitize_identifier(name: str) -> str:\n    cleaned = re.sub(r'[^A-Za-z0-9_]', '', name or '')\n    if not cleaned:\n        raise ValueError(f'Invalid identifier: {name!r}')\n    return cleaned\n\n# use before constructing the collection or fields\ncollection_name = sanitize_identifier(user_input)","typeGuard":"import re\n\ndef is_safe_identifier(name: str) -> bool:\n    return isinstance(name, str) and '\"' not in name and bool(re.match(r'^[A-Za-z_][A-Za-z0-9_]*$', name))","tryCatchPattern":"from semantic_kernel.exceptions import VectorStoreOperationException\n\ntry:\n    collection = OracleCollection(record_type=MyModel, collection_name=name)\nexcept VectorStoreOperationException as e:\n    if 'Invalid identifier with quotes' in str(e):\n        # strip quotes / sanitize the name and retry\n        ...","preventionTips":["Sanitize user-supplied table/column names with a regex like ^[A-Za-z_][A-Za-z0-9_]*$","Never pass untrusted input directly as an identifier","Use alphanumeric + underscore names only"],"tags":["oracle","validation","sql-injection","security"],"backgroundTag":null,"analyzedSha":"c028a0c7dc4f0814cdcbaba9d998f187a41197bf","analyzedAt":"2026-08-13T13:48:05.040Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}