# Named Queries won't allow parameterized table name? **URL:** \ **Category:** Ignition\ **Created:** [August 29, 2023, 3:48am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490 "2023-08-29T03:48:04Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![MCC](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@MCC](https://forum.inductiveautomation.com/u/MCC)\ **Post date:** [August 29, 2023, 3:48am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/1 "2023-08-29T03:48:04Z")
When setting up SELECT, INSERT and UPDATE named queries, I am finding that the test tab fails if the table name is parameterized. The error is > com.microsoft.sqlserver.jdbc.SQLServerException: Must declare the table variable "@P0". A simple example looks like this: ```auto SELECT [BatchID], [StartTime], [EndTime] FROM :tbl WHERE [StartTime] >= :sDate AND [EndTime] < :eDate ``` It fails whether the tbl parameter has quotes or doesn't. If I replace :tbl in the SQL with the table name it works fine. ---
**Author:** ![bmusson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bmusson/32/87530_2.png) [@bmusson](https://forum.inductiveautomation.com/u/bmusson)\ **Post date:** [August 29, 2023, 5:17am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/2 "2023-08-29T05:17:14Z")
You will need to make your table name as a QueryString parameter instead of a Value. ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/8/c/8c8603f9c101eeec9b6a99888832b481b967a60b.png) [https://docs.inductiveautomation.com/display/DOC81/Named+Query+Parameters](https://docs.inductiveautomation.com/display/DOC81/Named+Query+Parameters) ---
**Author:** ![Priyanka.Khandge](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/priyanka.khandge/32/35989_2.png) [@Priyanka.Khandge](https://forum.inductiveautomation.com/u/Priyanka.Khandge)\ **Post date:** [August 29, 2023, 5:22am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/3 "2023-08-29T05:22:15Z")
When passing the table name using the parameter then select parameter type **QuerString** ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/9/b9ca9d46c26c35ce2312baace18c63fd296fe8c5.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [August 29, 2023, 11:57am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/4 "2023-08-29T11:57:39Z")
But be careful how you deliver data to a queryString parameter, as such parameters re-open the SQL Injection security hole if given user-supplied data. That is, don't permit user-supplied data. If it will come from a user selection, use an index key in the UI, and perform a lookup to get the correct string at the point of the query. (The lookup would contain the valid possibilities.) The "more susceptible to SQL Injection" verbiage is just fluff. Either the technique is susceptible or it is not. Query strings are susceptible, themselves, and must be guarded. Value parameters are **not susceptible** to SQL Injection. That's the point. ---
**Author:** ![MCC](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@MCC](https://forum.inductiveautomation.com/u/MCC)\ **Post date:** [August 29, 2023, 3:38pm UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/5 "2023-08-29T15:38:16Z")
Shoot, I didn't even check the manual as I try to steer clear of QueryStrings due to their vulnerabilities. Thanks! ---
**Author:** ![srinivasan\_s](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@srinivasan\_s](https://forum.inductiveautomation.com/u/srinivasan_s)\ **Post date:** [July 31, 2024, 11:32am UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/6 "2024-07-31T11:32:22Z")
Hey Pturmel, I was facing similar issue with nambed query. This named query is bindind to report. Kindly help me on this. ![Capture34324](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/7/b738f8482306c87b59f0d7e835bc4674c13b8d50.png) Named query is working without putting the '' on querystring. If I put like '{tablename 2}'. It is throwing error. In report, neither working on puttingg '' nor with quotes for querystring in named query. ![Capture454365](https://us1.discourse-cdn.com/inductiveautomation/original/3X/b/6/b6ed395c892aeb80547c78f6f69b157fdf7a312d.png) ![Capture4665](https://us1.discourse-cdn.com/inductiveautomation/original/3X/9/d/9d4cccc710548289718ebd5a0dd6e87e4c0090a3.png) ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [July 31, 2024, 12:03pm UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/7 "2024-07-31T12:03:38Z")
- Show your query. - What brand of database is this? Certain brands don't accept SQL standard identifier quotes unless set to standards-compliant mode. (ANSI mode in SQL Server.) ---
**Author:** ![srinivasan\_s](https://avatars.discourse-cdn.com/v4/letter/s/eb9ed0/32.png) [@srinivasan\_s](https://forum.inductiveautomation.com/u/srinivasan_s)\ **Post date:** [July 31, 2024, 12:09pm UTC](https://forum.inductiveautomation.com/t/named-queries-wont-allow-parameterized-table-name/78490/8 "2024-07-31T12:09:32Z")
Hey pturmel. Now My issue is resolved,Thank you for your timely reply. 🤩