Sanitize request input before passing it to expression language evalu…

…ator

src/Bundle/Controller/ParametersParser.php

@@ -80,7 +80,7 @@ private function parseRequestValueExpression(string $expression, Request $reques
                 ));
             }
 
-            return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+            return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
         }, $expression);
 
         return $this->expression->evaluate($expression, ['container' => $this->container]);