TYPO3 Core

The QueryGenerator::makeOptionList function reads the label_alt field and uses it as a select field for a db query, forgetting that label_alt may contain multiple field names separated by commas. This leads to an invalid select field name and hence a db error, if the alternative label list does contain a comma.

https://github.com/TYPO3/TYPO3.CMS/blob/c384ce07fcfb33aab6301ce8453f712af8d09008/typo3/sysext/core/Classes/Database/QueryGenerator.php#L900

$altLabelField = $GLOBALS['TCA'][$from_table]['ctrl']['label_alt'];

…

if ($altLabelField) {
    $selectFields[] = $altLabelField;
}
$queryBuilder->select(...$selectFields)

https://docs.typo3.org/typo3cms/TCAReference/Ctrl/Index.html#label-alt

I discovered this bug while trying to edit a Direct Mail recipient list, based on a special query, based on the tt_address table with a custom select field referring to the static_country_zones table. That table has label_alt 'zn_name_local,zn_code' .