diff --git a/src/client/src/tscSQLParser.c b/src/client/src/tscSQLParser.c
index ec0c6a7c095d72befc7f2506bce12775496885dc..3f55cc21a9ed0805a983d6de5f7c00388963aae3 100644
--- a/src/client/src/tscSQLParser.c
+++ b/src/client/src/tscSQLParser.c
@@ -5666,7 +5666,16 @@ static int32_t validateTagCondExpr(SSqlCmd* pCmd, tExprNode *p) {
     if (!p->_node.pLeft || !p->_node.pRight) {
       break;
     }
-    
+
+    int32_t retVal = TSDB_CODE_SUCCESS;
+    if (p->_node.pLeft && (retVal = validateTagCondExpr(pCmd, p->_node.pLeft)) != TSDB_CODE_SUCCESS) {
+      return retVal;
+    }
+
+    if (p->_node.pRight && (retVal = validateTagCondExpr(pCmd, p->_node.pRight)) != TSDB_CODE_SUCCESS) {
+      return retVal;
+    }
+
     if (IS_ARITHMETIC_OPTR(p->_node.optr)) {
       return invalidOperationMsg(tscGetErrorMsgPayload(pCmd), msg1);
     }
@@ -5702,8 +5711,6 @@ static int32_t validateTagCondExpr(SSqlCmd* pCmd, tExprNode *p) {
       schemaType = TSDB_DATA_TYPE_DOUBLE;
     }
     
-    int32_t retVal = TSDB_CODE_SUCCESS;
-
     int32_t bufLen = 0;
     if (IS_NUMERIC_TYPE(vVariant->nType)) {
       bufLen = 60;  // The maximum length of string that a number is converted to.
diff --git a/src/query/src/qFilter.c b/src/query/src/qFilter.c
index ab1ebfe00953542462293f978b087492b4cc9806..bd840b1b8d619145971656f07bd78e3bfd12db6e 100644
--- a/src/query/src/qFilter.c
+++ b/src/query/src/qFilter.c
@@ -927,7 +927,9 @@ int32_t filterAddUnit(SFilterInfo *info, uint8_t optr, SFilterFieldId *left, SFi
     SFilterField *val = FILTER_UNIT_RIGHT_FIELD(info, u);  
     assert(FILTER_GET_FLAG(val->flag, FLD_TYPE_VALUE));
   } else {
-    assert(optr == TSDB_RELATION_ISNULL || optr == TSDB_RELATION_NOTNULL || optr == FILTER_DUMMY_EMPTY_OPTR);
+    if(optr != TSDB_RELATION_ISNULL && optr != TSDB_RELATION_NOTNULL && optr != FILTER_DUMMY_EMPTY_OPTR) {
+      return -1;
+    }
   }
   
   SFilterField *col = FILTER_UNIT_LEFT_FIELD(info, u);
@@ -1257,7 +1259,8 @@ int32_t filterAddGroupUnitFromNode(SFilterInfo *info, tExprNode* tree, SArray *g
   } else {
     filterAddFieldFromNode(info, tree->_node.pRight, &right);
     
-    filterAddUnit(info, tree->_node.optr, &left, &right, &uidx);
+    ret = filterAddUnit(info, tree->_node.optr, &left, &right, &uidx);
+    CHK_LRET(ret != TSDB_CODE_SUCCESS, TSDB_CODE_QRY_APP_ERROR, "invalid where condition");
 
     SFilterGroup fgroup = {0};
     filterAddUnitToGroup(&fgroup, uidx);
@@ -1574,7 +1577,9 @@ void filterDumpInfoToString(SFilterInfo *info, const char *msg, int32_t options)
         
         SFilterField *left = FILTER_UNIT_LEFT_FIELD(info, unit);
         SSchema *sch = left->desc;
-        len = sprintf(str, "UNIT[%d] => [%d][%s]  %s  [", i, sch->colId, sch->name, gOptrStr[unit->compare.optr].str);
+        if (unit->compare.optr >= TSDB_RELATION_INVALID && unit->compare.optr <= TSDB_RELATION_CONTAINS){
+          len = sprintf(str, "UNIT[%d] => [%d][%s]  %s  [", i, sch->colId, sch->name, gOptrStr[unit->compare.optr].str);
+        }
 
         if (unit->right.type == FLD_TYPE_VALUE && FILTER_UNIT_OPTR(unit) != TSDB_RELATION_IN) {
           SFilterField *right = FILTER_UNIT_RIGHT_FIELD(info, unit);
@@ -1591,7 +1596,9 @@ void filterDumpInfoToString(SFilterInfo *info, const char *msg, int32_t options)
 
         if (unit->compare.optr2) {
           strcat(str, " && ");
-          sprintf(str + strlen(str), "[%d][%s]  %s  [", sch->colId, sch->name, gOptrStr[unit->compare.optr2].str);
+          if (unit->compare.optr2 >= TSDB_RELATION_INVALID && unit->compare.optr2 <= TSDB_RELATION_CONTAINS){
+            sprintf(str + strlen(str), "[%d][%s]  %s  [", sch->colId, sch->name, gOptrStr[unit->compare.optr2].str);
+          }
           
           if (unit->right2.type == FLD_TYPE_VALUE && FILTER_UNIT_OPTR(unit) != TSDB_RELATION_IN) {
             SFilterField *right = FILTER_UNIT_RIGHT2_FIELD(info, unit);
diff --git a/tests/system-test/2-query/TD-12909.py b/tests/system-test/2-query/TD-12909.py
new file mode 100644
index 0000000000000000000000000000000000000000..7dd1a870c57b57a2d9e3ab517277fbbfc8cf1d52
--- /dev/null
+++ b/tests/system-test/2-query/TD-12909.py
@@ -0,0 +1,91 @@
+###################################################################
+#           Copyright (c) 2020 by TAOS Technologies, Inc.
+#                     All rights reserved.
+#
+#  This file is proprietary and confidential to TAOS Technologies.
+#  No part of this file may be reproduced, stored, transmitted,
+#  disclosed or used in any form or by any means other than as
+#  expressly provided by the written permission from Jianhui Tao
+#
+###################################################################
+# -*- coding: utf-8 -*-
+from posixpath import split
+import sys
+import os
+from util.log import *
+from util.cases import *
+from util.sql import *
+from util.dnodes import *
+class TDTestCase:
+    def init(self, conn, logSql):
+        tdLog.debug("start to execute %s" % __file__)
+        tdSql.init(conn.cursor(), logSql)
+
+        self.ts = 1420041600000 # 2015-01-01 00:00:00  this is begin time for first record
+        self.num = 10
+    def getBuildPath(self):
+        selfPath = os.path.dirname(os.path.realpath(__file__))
+        if ("community" in selfPath):
+            projPath = selfPath[:selfPath.find("community")]
+        else:
+            projPath = selfPath[:selfPath.find("tests")]
+        for root, dirs, files in os.walk(projPath):
+            if ("taosd" in files):
+                rootRealPath = os.path.dirname(os.path.realpath(root))
+                if ("packaging" not in rootRealPath):
+                    buildPath = root[:len(root) - len("/build/bin")]
+                    break
+        return buildPath
+    def caseDescription(self):
+        '''
+        case1 <wenzhouwww>: [TD-12909] :
+            this test case is for illegal SQL in query ,it will crash taosd.
+        '''
+        return
+
+    def run(self):
+        tdSql.prepare()
+        tdSql.execute("create database if not exists testdb keep 36500;")
+        tdSql.execute("use testdb;")
+        tdSql.execute("create stable st (ts timestamp , id int , value double) tags(hostname binary(10) ,ind int);")
+        for i in range(self.num):
+            tdSql.execute("insert into sub_%s using st tags('host_%s' , %d) values (%d , %d , %f );"%(str(i),str(i),i*10,self.ts+10000*i,i*2,i+10.00))
+        tdSql.query("select distinct(hostname) from testdb.st")
+        tdSql.checkRows(10)
+        tdSql.query("select count(*) from st where hostname >1")
+        tdSql.query("select count(*) from st where hostname >'1'")
+        tdSql.query("select count(*) from st where hostname <=1")
+        tdSql.query("select count(*) from st where hostname <='1'")
+        tdSql.query("select count(*) from st where hostname !=1")
+        tdSql.query("select count(*) from st where hostname !='1'")
+        tdSql.query("select count(*) from st where hostname <>1")
+        tdSql.query("select count(*) from st where hostname <>'1'")
+        tdSql.query("select count(*) from st where hostname in ('1','2')")
+        tdSql.query("select count(*) from st where hostname match '%'")
+        tdSql.query("select count(*) from st where hostname match '%1'")
+        tdSql.query("select count(*) from st where hostname between 1 and 2")
+        tdSql.query("select count(*) from st where hostname between 'abc' and 'def'")
+
+        tdSql.error("select count(*) from st where hostname between 1 and 2 or sum(1)")
+        tdSql.error("select count(*) from st where hostname < max(123)")
+
+        tdSql.error("select count(*) from st where hostname < max('abc')")
+        tdSql.error("select count(*) from st where hostname < max(min(123))")
+
+        tdSql.error("select count(*) from st where hostname < sum('abc')")
+        tdSql.error("select count(*) from st where hostname < sum(min(123))")
+
+        tdSql.error("select count(*) from st where hostname < diff('abc')")
+        tdSql.error("select count(*) from st where hostname < diff(min(123))")
+
+        tdSql.error("select count(*) from st where hostname < tbname")
+        tdSql.error("select count(*) from st where ts > 0 and tbname in ('d1', 'd2') and tbname-2")
+
+        tdSql.query("select count(*) from st where id > 10000000000000")
+
+    def stop(self):
+        tdSql.close()
+
+tdLog.success("%s successfully executed" % __file__)
+tdCases.addWindows(__file__, TDTestCase())
+tdCases.addLinux(__file__, TDTestCase())
\ No newline at end of file
diff --git a/tests/system-test/fulltest-query.sh b/tests/system-test/fulltest-query.sh
index efdbbe4047791dfa865d2897c63681fb6b41b9c6..eeb3871d92324be5dbb8902baa881eef79e55b9c 100755
--- a/tests/system-test/fulltest-query.sh
+++ b/tests/system-test/fulltest-query.sh
@@ -3,3 +3,4 @@ python3 ./test.py -f 2-query/TD-11256.py
 python3 ./test.py -f 2-query/TD-11945_crash.py
 python3 ./test.py -f 2-query/TD-12340-12342.py
 python3 ./test.py -f 2-query/TD-12344.py
+python3 ./test.py -f 2-query/TD-12909.py