From 9e411bc9cd4ed0ea9a27b4d1976851aa2cb2eeb6 Mon Sep 17 00:00:00 2001
From: yumoqing <yumoqing@gmail.com>
Date: Fri, 28 Aug 2026 16:55:40 +0800
Subject: [PATCH] =?UTF-8?q?fix(storefront):=20get=5Fproducts=5Fby=5Fcatego?=
 =?UTF-8?q?ry=20IN=E5=AD=90=E5=8F=A5sqlor=E5=8D=A0=E4=BD=8D=E7=AC=A6?=
 =?UTF-8?q?=E8=A2=ABf-string=E5=90=9E=E6=8E=89=E8=8A=B1=E6=8B=AC=E5=8F=B7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

f-string里${key}$被求值成$cid_0$(缺花括号),占位符原样进SQL报
Unknown column '$cid_0$'。${{org_id}}$/${{status}}$同理。
改为字符串拼接+双花括号转义,确保输出${cid_0}$格式。
---
 product_management/core.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/product_management/core.py b/product_management/core.py
index cafbbc4..2bd6778 100644
--- a/product_management/core.py
+++ b/product_management/core.py
@@ -89,11 +89,12 @@ class ProductManager:
                 return {'success': True, 'products': [], 'total': 0}
 
             # Use IN clause with proper parameterization
+            # sqlor 占位符格式为 ${name}$；f-string 里花括号需转义，否则 ${key} 会被求值
             param_keys = []
             params = {'org_id': org_id}
             for i, cid in enumerate(all_ids):
                 key = f'cid_{i}'
-                param_keys.append(f'${key}$')
+                param_keys.append('${' + key + '}$')
                 params[key] = cid
 
             placeholders = ','.join(param_keys)
@@ -101,8 +102,8 @@ class ProductManager:
                       FROM product p
                       LEFT JOIN product_category pc ON p.category_id = pc.id AND p.org_id = pc.org_id
                       WHERE p.category_id IN ({placeholders})
-                      AND p.org_id = ${org_id}$
-                      AND p.status = ${status}$
+                      AND p.org_id = ${{org_id}}$
+                      AND p.status = ${{status}}$
                       ORDER BY p.sort_order ASC, p.created_at DESC"""
             params['status'] = status