server/AyaNova/PickList/PickListSqlBuilder.cs

@@ -18,10 +18,11 @@ namespace AyaNova.PickList
         internal static string Build(IAyaPickList pickList, List<string> templateColumnNames, string autoCompleteQuery, string tagSpecificQuery, bool IncludeInactive)
         {
 
-       
+
             //determine this in advance as it will be used in a loop later
             bool HasAutoCompleteQuery = !string.IsNullOrWhiteSpace(autoCompleteQuery);
-          
+            bool HasTagSpecificQuery = !string.IsNullOrWhiteSpace(tagSpecificQuery);
+
 
             //lists to collect the clauses so to avoid comma fuckery
             List<string> lSelect = new List<string>();

server/AyaNova/biz/PickListBiz.cs

@@ -73,16 +73,26 @@ namespace AyaNova.Biz
                 {
                     // split the query on space
                     var querySegments = AutoCompleteQuery.Split(' ');
+                    if (querySegments.Length > 2)
+                    {
+                        AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid");
+                        return null;
+                    }
                     // users may type several spaces in a regular query, so ignore that and only use the first two segments
                     if (querySegments[0].Contains(".."))
                     {
                         TagSpecificQuery = querySegments[0].Replace("..", "");
-                        // the second string is considered the 
                         AutoCompleteQuery = querySegments[1];
                     }
+                    else if (querySegments[1].Contains(".."))
+                    {
+                        TagSpecificQuery = querySegments[1].Replace("..", "");
+                        AutoCompleteQuery = querySegments[0];
+                    }
                     else
                     {
-
+                        AddError(ApiErrorCode.VALIDATION_INVALID_VALUE, "query", "LT:PickListQueryInvalid");
+                        return null;
                     }
 
                 }