# SQL, checking multiple dynamic parameters **URL:** \ **Category:** Ignition\ **Created:** [October 19, 2022, 1:54pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401 "2022-10-19T13:54:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\ **Post date:** [October 19, 2022, 1:54pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/1 "2022-10-19T13:54:21Z")
I am trying to figure out how how I can configure the parameters in my where clause for my query to receive a list of the Skus to evaluate in the sorting. I know I need to work on my ranking too, but I think I can get that easy enough. ```auto select rank() over (partition by Line order by Net desc, Sku) as LineRank, Sku, Net, Scrap from myTable where Sku in ( ) group by Line ``` If I have like 20 skus, I don't want to do a big case statement. I am seeing some different implementations online, but none are really the thing. I thought maybe I could pass a byte array that gets set from an expression tag binding. * * * These were close: > [sql server 2008 - SQL Where clause with dynamic IN() operator - Stack Overflow](https://stackoverflow.com/questions/14314334/sql-where-clause-with-dynamic-in-operator) I think this one might work, where he passes a string that he parses. I might do this implementation. > [c# - Execute stored procedure with array-like string separated by comma - Stack Overflow](https://stackoverflow.com/questions/14257355/execute-stored-procedure-with-array-like-string-separated-by-comma) ---
**Author:** ![victordcq](https://avatars.discourse-cdn.com/v4/letter/v/f6c823/32.png) [@victordcq](https://forum.inductiveautomation.com/u/victordcq)\ **Post date:** [October 19, 2022, 2:46pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/2 "2022-10-19T14:46:45Z")
You can use a querystring instead of a value, You'll have to parse the value correct ofc with quotes and commas ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/3/d/3d6ebfdb7737e843646f000af675aa38b6eeaecd.png) ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/7/9/79535dd0c82f56f1619a720deb0a3927bf68525e.png) ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 19, 2022, 3:13pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/3 "2022-10-19T15:13:06Z")
Are you using a named query or a scripting function? ---
**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\ **Post date:** [October 19, 2022, 3:48pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/4 "2022-10-19T15:48:28Z")
I planned to use a named query. edit: If I ran a script, I use ~~named queries~~ **runPrepUpdate** in those cases. * * * Thanks Victor I think that is what I will use. Looks efficient. ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [October 19, 2022, 6:28pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/5 "2022-10-19T18:28:09Z")
You should never use queryString parameters with user input. You can sanitize your dropdowns with indirection, but any text search fields are a security breach waiting to happen. If scripting, construct "Prep" queries with the correct number of question marks and make sure your argument list matches. If not scripting, reconsider. ---
**Author:** ![zacht](https://avatars.discourse-cdn.com/v4/letter/z/ea5d25/32.png) [@zacht](https://forum.inductiveautomation.com/u/zacht)\ **Post date:** [October 19, 2022, 6:37pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/6 "2022-10-19T18:37:40Z")
As a specific example of @pturmel's suggestion: > [@prepQuery with WHERE IN() statement](https://forum.inductiveautomation.com/t/prepquery-with-where-in-statement/55359/3): > > usages = [301,311] queryString = """SELECT \* FROM distribution\_config WHERE usage\_id IN ({})""".format(','.join(['?']\*len(usages))) pyds = system.db.runPrepQuery(queryString,usages,"base\_administrateur") ---
**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\ **Post date:** [October 19, 2022, 6:56pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/7 "2022-10-19T18:56:15Z")
Thanks for helping me. I wasn't using queryString. I was using a table component with a named query that had parameter to bind to a component on the perspective page. I use runPrepUpdate() in scripts. I had a typing error in my previous post. Sorry for the confusion. * * * Oh, Victor's example is a queryString. I did not realize that till just now. ---
**Author:** ![zacharyw.larson](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/zacharyw.larson/32/23749_2.png) [@zacharyw.larson](https://forum.inductiveautomation.com/u/zacharyw.larson)\ **Post date:** [October 20, 2022, 8:56pm UTC](https://forum.inductiveautomation.com/t/sql-checking-multiple-dynamic-parameters/65401/8 "2022-10-20T20:56:06Z")
I will probably use @zacht's example code in a script. Before I get my list of Skus to get ranks though: **What would be a good component to let users efficiently pick which of 20 Skus they wanted to utilize in the query?** I think clicking on 20 radial dials or check boxes would be terrible. I would like to have maybe a drag selection maybe if possible, so maybe a user could draw a box around some to add to the current list. Or maybe I can have them in a table that they can click and drag on that I could color, is that doable?