# Sometimes get 'broken' SQL binding on Vision window Numeric Text Box

**URL:** <https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217>\
**Category:** Ignition\
**Tags:** ignition81, vision, database\
**Created:** [August 1, 2023, 1:12pm UTC](https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217 "2023-08-01T13:12:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeff.ryan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jeff.ryan/32/25543_2.png) [@jeff.ryan](https://forum.inductiveautomation.com/u/jeff.ryan)\
**Post date:** [August 1, 2023, 1:12pm UTC](https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217/1 "2023-08-01T13:12:26Z")

</div>

![Untitled](https://us1.discourse-cdn.com/inductiveautomation/original/3X/c/f/cf3acfe256bd08746e7ff034237d217aa310b965.png)

Hello,  
Ignition 8.1.26, Vision, window, Numeric Text Box, bound to a SQL Query. Per this screen shot, attached pic, when the user invokes this form, it is often coming up 'red' with this 'broken link' error. All data seems to be valid.

```
It is a Numeric Text Box in the pic to the left of this, also bound to a SQL query that has never had this problem. I was suspecting a performance, not reading the data in time problem, but why don't most of the other SQL bound text boxes on the form have this problem. Both SQL queries, labeled good/bad are noted below. Should I use a Named Query instead. Any ideas for troubleshooting? Thanks.

```

Problem:  
SELECT [Billet Length (IN)]   
FROM FurnaceSetup  
WHERE DieID = '{Root Container.ContainerRecipe.DieID.selectedStringValue}' And  
Copy = {Root Container.ContainerRecipe.Copy.intValue} And  
Alloy = '{Root Container.ContainerRecipe.Alloy.text}'

No problems:  
SELECT BilletLength   
FROM Production  
WHERE RunID = {Root Container.RunID}

---

<div class="post-metadata">

**Author:** ![MMaynard](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/mmaynard/32/3366_2.png) [@MMaynard](https://forum.inductiveautomation.com/u/MMaynard)\
**Post date:** [August 1, 2023, 1:21pm UTC](https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217/2 "2023-08-01T13:21:25Z")

</div>

In designer when it is showing as Error, right click the control and select Diagnostics.  
This will show the cause of the error.

---

<div class="post-metadata">

**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\
**Post date:** [August 1, 2023, 1:34pm UTC](https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217/3 "2023-08-01T13:34:30Z")

</div>

You are using string substitution to supply parameters to your query. Curly braces in standard SQL queries perform brainless (and dangerous) string conversion and insertion. Any character in your alloy text that doesn't behave in the quoted string will break that SQL and permit security hacking of your database. (AKA SQL Injection.)

Convert to a named query and use value parameters. Then turn off legacy DB permissions in the project properties so no-one re-introduces this security hazard.

---

<div class="post-metadata">

**Author:** ![jeff.ryan](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/jeff.ryan/32/25543_2.png) [@jeff.ryan](https://forum.inductiveautomation.com/u/jeff.ryan)\
**Post date:** [August 1, 2023, 1:48pm UTC](https://forum.inductiveautomation.com/t/sometimes-get-broken-sql-binding-on-vision-window-numeric-text-box/77217/4 "2023-08-01T13:48:18Z")

</div>

OK. Thank you.