# Simple RunPrepQuery Issue

**URL:** <https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180>\
**Category:** Ignition\
**Tags:** ignition81, scripting, database\
**Created:** [August 21, 2023, 8:13pm UTC](https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180 "2023-08-21T20:13:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jaden\_Steinbacher](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@Jaden\_Steinbacher](https://forum.inductiveautomation.com/u/Jaden_Steinbacher)\
**Post date:** [August 21, 2023, 8:13pm UTC](https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180/1 "2023-08-21T20:13:05Z")

</div>

Hi,  
I am having an issue with a very simple query I am trying to run. I am trying to get all the data from the table by its name.  
The code is below.

```auto
query = "SELECT * FROM ?"
s = "DrillPlates"
t = system.db.runPrepQuery(query, [s], "FASTDev")

```

So using this logic should be the same as running a script like

```auto
query = "SELECT * FROM DrillPlates"
test = system.db.runQuery(query,"FASTDev")

```

The bottom logic works fine as I expect the top logic causes an error  
java.lang.Exception: java.lang.Exception: Error executing system.db.runPrepQuery(SELECT \* FROM ?, , [DrillPlates], )

I am not sure why there is an error when these are the same query scripts just one is having the string argument prepped and the other is not. Any help is appreciated thank you.  
All the testing for these scripts were in the script console on my client project.

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [August 21, 2023, 8:20pm UTC](https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180/2 "2023-08-21T20:20:18Z")

</div>

JDBC will not allow you to provide SCHEMA information via parameters (e,g. column names, table names, commands, etc.)

You can do this via NamedQueries and utilizing a QueryString parameter, but be sure to not allow user entered data directly into that parameter.

---

<div class="post-metadata">

**Author:** ![Jaden\_Steinbacher](https://avatars.discourse-cdn.com/v4/letter/j/b782af/32.png) [@Jaden\_Steinbacher](https://forum.inductiveautomation.com/u/Jaden_Steinbacher)\
**Post date:** [August 21, 2023, 8:25pm UTC](https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180/3 "2023-08-21T20:25:34Z")

</div>

Ok thank you for the information. I assume this is a preventive measure so tables are not destructed when running queries?

---

<div class="post-metadata">

**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\
**Post date:** [August 21, 2023, 8:26pm UTC](https://forum.inductiveautomation.com/t/simple-runprepquery-issue/78180/4 "2023-08-21T20:26:22Z")

</div>

> [@Jaden\_Steinbacher](#):
>
> I assume this is a preventive measure so tables are not destructed when running queries?

Yes, it is part of the hardening against SQL Injection.