Are query parameters broken in SEDE

Question

I didn't notice this earlier but for some reason it looks like the query parameter functionality is broken for me when editing a query.

If I run this query from the edit view

declare @title nvarchar(50) = ##title:string##
print '|'+ @title +'|'

the result is, if I enter test in the title field,

|,test|

Where does that comma at the start come from?

Strangely enough if I simply run that same query from the permalink all works as expected, no comma is added.

If I remove the type indicator like so:

declare @title nvarchar(50) = ##title##
print '|'+ @title +'|'

I'm greeted with an error:

Incorrect syntax near ','. Must declare the scalar variable "@title".

enclosing the parameter in quotes fixes that but then my result is the same as previous, I get an extra comma.

If I added the type again while the query parameter is within quotes like so:

declare @title nvarchar(50) = '##title:string##'
print '|'+ @title +'|'

I'm back at the previous error.

I tried to move the query parameter out of the declare

declare @title nvarchar(50)
set @title = ##title:string##

but that didn't help.

I can reproduce this in both IE11 and Google Chrome.

For the time being I'll do a replace(@title, ',','').

If this is indeed a bug, can this be fixed, please?

Answer 1

Ok, I found the root-cause.

The field title is already submitted in the form. So if you choose your variable names don't use ones that are already part of the payload.

this will work:

declare @somevar nvarchar(50) = ##notitle:string##
print '|'+ @somevar +'|'

When you hit run the following formdata is submitted:

title:
description:
sql:declare @somevar nvarchar(50) = ##notitle:string##
notitle:test

With a query parameter called title the following payload is posted:

title:
description:
sql:declare @somevar nvarchar(50) = ##title:string##
print '|'+ @somevar +'|'
title:test

Notice the double title in the form parameters

Executing that with a title gives you this result:

So to prevent this bug/feature don't use the following names for your query parameters:

title
description
sql
recaptcha_challenge_field
recaptcha_response_field