Injection-Proof Vendor Search

Injection-Proof Vendor Search

Procurement wants a lookup where buyers paste vendor names straight out of supplier spreadsheets — sometimes one name, sometimes a whole column of them. The first prototype pasted that text into a record filter, and the bug reports wrote themselves: searching for O'Connor & Sons crashes, searching for Import|Export GmbH returns two unrelated vendors instead of the right one, and 1..10 Logistics quietly matches vendors that have nothing to do with it. A filter string is a tiny query language, and pasting user text into one is AL's version of SQL injection.

Your job is a search codeunit where every character of a searched name is treated as data — never as filter syntax.

Requirements

Create a codeunit named "Vendor Search" with two public procedures:

procedure ExactNameFilter(SearchName: Text): Text
procedure ApplyNameSearch(var Vendor: Record Vendor; SearchNames: List of [Text])

Rules:

1. ExactNameFilter returns a filter expression for the Name field of Vendor: when a caller passes your return value to SetFilter on Name, exactly the vendors whose Name equals SearchName remain visible — every character taken literally (|, &, .., <, >, (, ), =, @ and apostrophes included) and letter case ignored. Two vendors sharing the searched name both remain; a vendor whose name only an either/or, range or symbol-stripped reading would catch must not.