# Problem with a report datasource query

**URL:** <https://forum.inductiveautomation.com/t/problem-with-a-report-datasource-query/16002>\
**Category:** Ignition\
**Created:** [November 15, 2017, 1:31pm UTC](https://forum.inductiveautomation.com/t/problem-with-a-report-datasource-query/16002 "2017-11-15T13:31:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mjcostel](https://avatars.discourse-cdn.com/v4/letter/m/b2d939/32.png) [@mjcostel](https://forum.inductiveautomation.com/u/mjcostel)\
**Post date:** [November 15, 2017, 1:31pm UTC](https://forum.inductiveautomation.com/t/problem-with-a-report-datasource-query/16002/1 "2017-11-15T13:31:54Z")

</div>

I am trying to create a query that will pull in different data based on a Where clause manipulation. I want to have a parameter pull from a string tag that will be the column name of the table. The idea being I can dynamically change what column the query is limiting on. The problem is that I always get a null set. Please see the query below. The final ? in the query is a parameter that points at a string tag that has the value Sampler (Sampler being the name of a table column). When I change the query and just put in ‘Sampler’ directly and don’t use a parameter it works fine. I also am able to put in a parameter in for the value that the column needs to compare to and have that work as well. Can the query not substitute a table column through a parameter?

I find it interesting that I don’t get a query error but just a null set.

SELECT Result.StartDateSampled,Result.ResultFloat, Limit.OutFallID, OutFall.CustomerID, Result.ParamName, Limit.MaxOrMinLimit, Limit.SingleResultLimit, Limit.AvgResultLimit, Parameter.MajorGrp  
FROM Result, Limit, OutFall, Parameter  
WHERE Result.LimitID= Limit.LimitID and Result.ParamID= Parameter.ParamID and Limit.OutFallID=OutFall.OutFallID and OutFall.CustomerID = ? and Result.StartDateSampled \> ? and Result.StartDateSampled \< ? and ? = ‘City’

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [November 15, 2017, 1:39pm UTC](https://forum.inductiveautomation.com/t/problem-with-a-report-datasource-query/16002/2 "2017-11-15T13:39:37Z")

</div>

No SQL driver I know of allows parameter substitution to change the query _structure_. In fact, to avoid SQL-injection security breaches, you can’t allow it. You will have to perform regular string substitution on that column name prior to delivering it to system.db.runPrep\*(). To be secure, your code will have to be designed to ensure only a real column name can be supplied there.

---

<div class="post-metadata">

**Author:** ![KathyApplebaum](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kathyapplebaum/32/7261_2.png) [@KathyApplebaum](https://forum.inductiveautomation.com/u/KathyApplebaum)\
**Post date:** [November 15, 2017, 2:56pm UTC](https://forum.inductiveautomation.com/t/problem-with-a-report-datasource-query/16002/3 "2017-11-15T14:56:57Z")

</div>

Just as a note, you _can_ change column names dynamically if you use a named query as your report data source. But like Phil said, you will be vulnerable to SQL injection if you do, so use at your own risk.