# SQL Injection - Best Practices

**URL:** <https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608>\
**Category:** Ignition\
**Created:** [June 27, 2023, 8:22pm UTC](https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608 "2023-06-27T20:22:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ntheuer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@ntheuer](https://forum.inductiveautomation.com/u/ntheuer)\
**Post date:** [June 27, 2023, 8:22pm UTC](https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608/1 "2023-06-27T20:22:05Z")

</div>

This was brought to my attention as being bad practice. I could easily move this to a named query, and have no issue or problem doing that; but I think named queries have a time and place. If I am using a query only 1 time for a singular purpose, I generally like to have it in the table local.

Does this open the door (as my criticism suggests) to any sort of SQL injection? Does the table component have any sort of security that would prevent external string manipulation for variables 'query'

I absolutely want to follow best practice, but I also like having some things the way that I have them. Am I in the wrong here?

 ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/1/3/13f890643be69b4846c0e9321cebf08491b37342.png)

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [June 27, 2023, 8:24pm UTC](https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608/2 "2023-06-27T20:24:45Z")

</div>

Since you're not using any kind of string formatting to build your query (you're not) then you're fine, no SQL injection risk. The `prep` variants of the SQL query functions are 'safe' against SQL injection (for parameters) as long as you're not opening your own hole by accepting user input into the actual query body.

---

<div class="post-metadata">

**Author:** ![ntheuer](https://avatars.discourse-cdn.com/v4/letter/n/ccd318/32.png) [@ntheuer](https://forum.inductiveautomation.com/u/ntheuer)\
**Post date:** [June 27, 2023, 8:39pm UTC](https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608/3 "2023-06-27T20:39:05Z")

</div>

thank you for the feedback!

---

<div class="post-metadata">

**Author:** ![Transistor](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/transistor/32/3380_2.png) [@Transistor](https://forum.inductiveautomation.com/u/Transistor)\
**Post date:** [June 27, 2023, 8:41pm UTC](https://forum.inductiveautomation.com/t/sql-injection-best-practices/75608/4 "2023-06-27T20:41:34Z")

</div>

Tip: post code, not pictures of code, so we can copy it into our answers and edit it. Use the \</\> button to format it as code to preserve indents and apply syntax highlighting.