# SQL Statement From Parameter, Report

**URL:** <https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050>\
**Category:** Ignition\
**Created:** [August 19, 2016, 10:22pm UTC](https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050 "2016-08-19T22:22:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bfearnow](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bfearnow/32/3337_2.png) [@bfearnow](https://forum.inductiveautomation.com/u/bfearnow)\
**Post date:** [August 19, 2016, 10:22pm UTC](https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050/1 "2016-08-19T22:22:23Z")

</div>

Is it possible to pass something like:

‘IND=1 OR IND=2’

as a parameter in the report designer to a query like:

SELECT \* FROM plant WHERE ?

If so I must be doing something wrong. Thanks in advance.

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [August 19, 2016, 11:06pm UTC](https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050/2 "2016-08-19T23:06:01Z")

</div>

You can’t pass the structure of a SQL query in as a parameter - the nature of parameters (and why they’re safe from SQL injection) is that they have to be an exact match of placeholders to values. So, SELECT \* FROM PLANT WHERE IND = ? OR IND = ? would work fine - and you could do something with the logic calling your query to pass it the same value twice if there’s only one value, or something similar - but that’s the limitation of prepared statements.

You could also do a system.db call to execute an arbitrary query, in which case you could do something like this:  
system.db.runUpdateQuery(‘SELECT \* FROM PLANT WHERE %s’ % ‘IND = 1 OR IND = 2’)

But it’s very important to realize that this is not ‘safe’ from malicious user input - a user could input whatever arbitrary string they want to.

---

<div class="post-metadata">

**Author:** ![bfearnow](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bfearnow/32/3337_2.png) [@bfearnow](https://forum.inductiveautomation.com/u/bfearnow)\
**Post date:** [August 20, 2016, 4:32pm UTC](https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050/3 "2016-08-20T16:32:06Z")

</div>

Thanks for your help Paul. I am having a mental block on how to do this, but I am trying to set up a nested query in the report

Plant  
Department  
Line

The user has the ability from a table on a window to select what plant(s), department(s), line(s) they want the report to query. I cannot figure out some way to pass a list of indexes to the report. I am trying to avoid scripting nested queries, but I did see an example on how to do this in the forum recently. Any other recommendations?

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [August 24, 2016, 6:24pm UTC](https://forum.inductiveautomation.com/t/sql-statement-from-parameter-report/12050/4 "2016-08-24T18:24:19Z")

</div>

You could use a ‘Basic Query’ datasource, and then something like this:

`SELECT example.note
FROM example
WHERE example.id IN ({Index})`

While using a string parameter named Index. Then just pass in Index parameters as comma-separated values, ie: ‘1, 2, 3’ and you should see the indexes returned by your query.

The standard SQL Query datasource creates a prepared statement, so you won’t be able to do this value substitution (without nested queries).