Can Cypher interpret HTML character codes as input?

[Ooker]

Occasionally I need to use HTML character codes as a part of the query string, like &#8217 for ', and ] for ]. I know that there is a way to convert them back to the proper characters to be able to use Cypher, but is there a way to make Cypher automatically decode them?That would be neater.

So for example if my query is

match (n)-[r]-(m) where n.gid=’Cx’ and m.gid=’Cx’ return n,r,m

it will understand as

match (n)-[r]-(m) where n.gid='Cx' and m.gid='Cx' return n,r,m

[david_allen]

There are a couple of different ways of doing this, but I would check out apoc.text.urldecode here

Neo4j Graph Database Platform

apoc.text.urldecode - APOC Documentation

This section contains reference documentation for the apoc.text.urldecode function.

However -- the code that you've got here suggests that the cypher query itself is being submitted as a URL encoded string, and that you are interpolating that URL encoded data as part of an actual cypher query. If this is the case, please reconsider your approach because it would likely make your application vulnerable to a security problem called cypher query injection. You can read more about that here

Neo4j Graph Database Platform

Protecting against Cypher injection - Knowledge Base

What is Cypher injection? Cypher injection is a way for maliciously formatted input to jump out of its context, and by altering the query itself, hijack the query and perform…

[Ooker]

Thanks for the info. However, this is a HTML entity, not percent-encoding that is used for URL. My input is in a div, i.e.

<div id="foo" data-function="bar">match (n)-[r]-() where n.gid='Cx' return n,r</div>

and the ' character is being converted before putting it into a string.