# Conditional MariaDB query using Dates

**URL:** <https://forum.inductiveautomation.com/t/conditional-mariadb-query-using-dates/91428>\
**Category:** Ignition\
**Tags:** scripting\
**Created:** [June 5, 2024, 5:35pm UTC](https://forum.inductiveautomation.com/t/conditional-mariadb-query-using-dates/91428 "2024-06-05T17:35:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![MG3](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mg3/32/84125_2.png) [@MG3](https://forum.inductiveautomation.com/u/MG3)\
**Post date:** [June 5, 2024, 5:35pm UTC](https://forum.inductiveautomation.com/t/conditional-mariadb-query-using-dates/91428/1 "2024-06-05T17:35:19Z")

</div>

Hi all,

Just hoping someone can give me a hand, I am trying filter out rows from a MariaDB database using a start and end date as conditions. Currently, I am getting a SQL Error from the current script and I am unsure why, anyone able to offer advice? (NOTE: for this demo code I am using the alarm\_events table but it is identical in my other code for a different database.)

```python
startDate = system.date.addDays(system.date.now(), -1)
endDate = system.date.now()

query="SELECT * FROM alarm_events WHERE eventtime >= {startDate} AND eventtime <= {endDate} ORDER BY eventtime DESC".format(startDate=startDate, endDate=endDate)

result = system.db.runQuery(query)

for row in result:
	rowData = [item for item in row]
	print(rowData)

```

Any help is appreciated.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 5, 2024, 5:59pm UTC](https://forum.inductiveautomation.com/t/conditional-mariadb-query-using-dates/91428/2 "2024-06-05T17:59:11Z")

</div>

**Always** use `system.db.runPrepQuery` over `runQuery` if you need any arguments. Seriously, always.

Right now you're relying on whatever string formatting for a date happens to get inserted into your SQL query. This is bad; it's locale and scripting environment dependent, it's a performance cliff, it's a practice that can lead to SQL injection vulnerabilities - it's just a bad time all around.

Using `system.db.runPrepQuery`, you can substitute arbitrary Python and Java **objects** into your query, and they will be sent "as-is" (subject to what the JDBC driver involved can deal with) to your DB - with no lossy formatting to string.

Just changing the `query` and `result` lines should do it:

```python
query = """
	SELECT * 
	FROM alarm_events 
	WHERE eventtime >= ? 
	AND eventtime <= ? 
	ORDER BY eventtime DESC
"""

result = system.db.runPrepQuery(query, [startDate, endDate])

```

---

<div class="post-metadata">

**Author:** ![MG3](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mg3/32/84125_2.png) [@MG3](https://forum.inductiveautomation.com/u/MG3)\
**Post date:** [June 6, 2024, 9:16am UTC](https://forum.inductiveautomation.com/t/conditional-mariadb-query-using-dates/91428/3 "2024-06-06T09:16:45Z")

</div>

Excellent thankyou that worked a charm!