diff --git a/product_management/core.py b/product_management/core.py
index cafbbc4..2bd6778 100644
--- a/product_management/core.py
+++ b/product_management/core.py
@@ -89,11 +89,12 @@ class ProductManager:
                 return {'success': True, 'products': [], 'total': 0}
 
             # Use IN clause with proper parameterization
+            # sqlor 占位符格式为 ${name}$；f-string 里花括号需转义，否则 ${key} 会被求值
             param_keys = []
             params = {'org_id': org_id}
             for i, cid in enumerate(all_ids):
                 key = f'cid_{i}'
-                param_keys.append(f'${key}$')
+                param_keys.append('${' + key + '}$')
                 params[key] = cid
 
             placeholders = ','.join(param_keys)
@@ -101,8 +102,8 @@ class ProductManager:
                       FROM product p
                       LEFT JOIN product_category pc ON p.category_id = pc.id AND p.org_id = pc.org_id
                       WHERE p.category_id IN ({placeholders})
-                      AND p.org_id = ${org_id}$
-                      AND p.status = ${status}$
+                      AND p.org_id = ${{org_id}}$
+                      AND p.status = ${{status}}$
                       ORDER BY p.sort_order ASC, p.created_at DESC"""
             params['status'] = status