# Ignition treats parameter value in WHERE clause as a literal, not a string **URL:** \ **Category:** Ignition\ **Tags:** ignition81\ **Created:** [November 13, 2023, 3:00pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814 "2023-11-13T15:00:45Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![szcz](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@szcz](https://forum.inductiveautomation.com/u/szcz)\ **Post date:** [November 13, 2023, 3:00pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/1 "2023-11-13T15:00:45Z")
Hi, I can't explain the behaviour I am experiencing. It ties to work with strings in Python (running Jython 2.7.2). Consider following line of code ![obrazek](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/c/2c1aa3a49c1631d5be642765de920d06ef326923.png) The query is receiving two parameters - table name and value we search for in the column Statistic. You can see that around first parameter (table name) there aren't any apostrophes, around the second there are (because it's a value we look for). When passing in a table name XYZ and col\_name of value 'Assigned', we get a complaint "there's no column Assigned in the table". However, if we copy the script to script editor and try to assemble the string, the result is correct -\> Table name is "installed" to the T-SQL as it should be and query ends with Statistics = 'Assigned'. Running this query in query editor yields success. Running the query as a script, however, gives us this error. Any hints appreciated ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [November 13, 2023, 3:11pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/2 "2023-11-13T15:11:40Z")
Table names, column name, schema names, et cetera, are **structure** in a query, not **values** , and cannot be substituted with prep query question marks or named query value parameters. This is fundamental to database APIs, as structure is needed by databases to construct an execution plan, where values can be inserted into queries after planning. If you absolutely must do this, you will have to dynamically construct those parts of your queries. (Keep in mind that this is a huge security risk, if there is any chance user input could be included.) ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [November 13, 2023, 5:56pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/3 "2023-11-13T17:56:48Z")
> [@pturmel](#): > > Table names, column name, schema names, et cetera, are **structure** in a query, not **values** , and cannot be substituted with prep query question marks or named query value parameters All 100% accurate, however, that line of code is doing string formatting and isn't using Prep Query place holders. I would assume that they _are_ dynamically building the query. Need to see more code, particularly where they are calling which ever `system.db.*` function they are using. Not to mention that the error they are stating doesn't align with the query they are showing, which makes me think there is most likely some type of scoping issue, where a previous query is leaking into this call or something. ---
**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\ **Post date:** [November 13, 2023, 5:59pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/4 "2023-11-13T17:59:29Z")
@szcz, please post formatted code - not pictures of code. Then we can copy an edit in our answers and / or test environment. > [@Wiki - how to post code on this forum](https://forum.inductiveautomation.com/t/wiki-how-to-post-code-on-this-forum/77831): > > This thread is intended as a short help file for all those struggling to post formatted code on the forum. Posting formatted code on the forum (and most others) is as simple as selecting the code and pressing the \ button. It works the same as applying Bold or Italic styles to your document. It preserves indentation and applies syntax highlighting. [How to post code] ---
**Author:** ![szcz](https://avatars.discourse-cdn.com/v4/letter/s/ec9cab/32.png) [@szcz](https://forum.inductiveautomation.com/u/szcz)\ **Post date:** [November 14, 2023, 4:55pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/5 "2023-11-14T16:55:17Z")
Hello all, sorry for late reply. As Irose wrote, the main problem was really with string formating - i.e. we were replacing `%s` in the query with variable values to build complete query string before sending it to `system.db.runQuery()`. As much as this is not understandable for me, it is fixed by me, opening the Designer, shaping the code as it should look like and saving it. Now the code runs flawlessly. From that time on, it works although on PC of my colleague yesterday, the very same string formatting code did not work. The only explanation I have is quite esoteric but I explain that to myself that in the code could have been some white character wreaking havoc. Thank you all for your effort. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [November 14, 2023, 5:13pm UTC](https://forum.inductiveautomation.com/t/ignition-treats-parameter-value-in-where-clause-as-a-literal-not-a-string/81814/6 "2023-11-14T17:13:52Z")
> [@szcz](#): > > we were replacing `%s` in the query with variable values to build complete query string before sending it to `system.db.runQuery()` You should consider using `system.db.runPrepQuery()` and only provide the dynamic table name when building the query, and then use the `?` place holder for filter condition. That way at least part of the dynamically provided values can be sanitized and provide a little smaller risk.