pr feedback: escape backslash & update comments

Author: vas3a

src/billing-accounts/billing-accounts.controller.ts

@@ -106,7 +106,7 @@ export class BillingAccountsController {
     type: Number,
   })
   async listByUserIds(@Param("userId", ParseIntPipe) userId: number) {
-    return await this.service.listByUserId(userId);
+    return this.service.listByUserId(userId);
   }
 
   @Get(":billingAccountId")

src/billing-accounts/billing-accounts.service.ts

@@ -19,13 +19,13 @@ export class BillingAccountsService {
 
   /**
    * List billing accounts one or more user IDs have access to (via Salesforce resource object).
-   * Accepts a single userId (string) or an array of userId strings.
+   * Accepts a single userId (number) or an array of userId strings.
    */
   async listByUserId(userId: number) {
     const { accessToken, instanceUrl } = await this.salesforce.authenticate();
 
-    // escape single quotes and build IN clause
-    const escaped = `'${String(userId).replace(/'/g, "\\'")}'`;
+    // escape backslashes and single quotes and build IN clause
+    const escaped = `'${String(userId).replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
     const nameField =
       process.env.SFDC_BILLING_ACCOUNT_NAME_FIELD || "Billing_Account_name__c";
     const sql = `SELECT Topcoder_Billing_Account__r.Id, Topcoder_Billing_Account__r.TopCoder_Billing_Account_Id__c, Topcoder_Billing_Account__r.${nameField}, Topcoder_Billing_Account__r.Start_Date__c, Topcoder_Billing_Account__r.End_Date__c FROM Topcoder_Billing_Account_Resource__c tbar WHERE Topcoder_Billing_Account__r.Active__c=true AND UserID__c = ${escaped}`;