# Table Name Argument in Prep Query

**URL:** <https://forum.inductiveautomation.com/t/table-name-argument-in-prep-query/84904>\
**Category:** Ignition\
**Tags:** perspective\
**Created:** [January 29, 2024, 4:03pm UTC](https://forum.inductiveautomation.com/t/table-name-argument-in-prep-query/84904 "2024-01-29T16:03:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Salem\_Marshall](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@Salem\_Marshall](https://forum.inductiveautomation.com/u/Salem_Marshall)\
**Post date:** [January 29, 2024, 4:03pm UTC](https://forum.inductiveautomation.com/t/table-name-argument-in-prep-query/84904/1 "2024-01-29T16:03:55Z")

</div>

I have a question regarding arguments within prep queries in perspective scripting.

Is it possible to parameterize a table name using arguments within a PrepUpdate query? I want to insert a value into a database table based on the table the user chooses. The user choice comes from a dropdown, so I don't think it opens me up to a SQL injection attack. Simplified example:

```auto
userChoice = "Warehouse"
value = 123
query = "INSERT INTO (?) VALUES (?)"
args = [userChoice,value]
system.db.runPrepUpdate(query,args)

```

I know I could use a Named Query, but from my understanding prep queries are faster? Thanks for any help!

---

<div class="post-metadata">

**Author:** ![paul-griffith](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/paul-griffith/32/37249_2.png) [@paul-griffith](https://forum.inductiveautomation.com/u/paul-griffith)\
**Post date:** [January 29, 2024, 4:10pm UTC](https://forum.inductiveautomation.com/t/table-name-argument-in-prep-query/84904/2 "2024-01-29T16:10:46Z")

</div>

No, you can't parameterize the table name, because it's part of the structure of the query, not the arguments.

If you _actually_ need dynamic SQL, then your options are assembling the query and executing it via scripting, or using a named query using the (unsafe) query string parameter type.

In either case, **do not accept arbitrary user input unvalidated** , as both are open to SQL injection vulnerabilities.

> [@Salem\_Marshall](#):
>
> I know I could use a Named Query, but from my understanding prep queries are faster?

I'm curious where you got that impression from. I haven't really done any benchmarking, but the slowest part of the underlying execution (the round trip to the DB) is going to be using the exact same JDBC mechanisms, so I would expect either approach to be basically the same, speed wise. Especially since _safely_ calling a named query with query string parameters _requires_ a script in front of it to validate inputs.

---

<div class="post-metadata">

**Author:** ![Salem\_Marshall](https://avatars.discourse-cdn.com/v4/letter/s/b38774/32.png) [@Salem\_Marshall](https://forum.inductiveautomation.com/u/Salem_Marshall)\
**Post date:** [January 29, 2024, 4:16pm UTC](https://forum.inductiveautomation.com/t/table-name-argument-in-prep-query/84904/3 "2024-01-29T16:16:18Z")

</div>

Gotcha, thanks! Honestly, someone that was helping me with Ignition told me about the speed thing. I was wondering why/if it was true. But I generally find it easier to see the query within my script, so I would've mostly been using prep queries either way.