I’d like to set a result set table that’s personalized for each user. What I had in mind was something like “tmp_”+:UserName and I would have the user name taken from the session variable for that. Trying this out in the named query section, it doesn’t seem to allow that though. Is there way to pass a parameter as a table name or is that not supported in Ignition/MySQL?
Schema names, table names, and column names are all part of a SQL statement’s structure, not data, so normal substitution is not allowed (at the JDBC level). Named queries can have “QueryString” parameters for such, which use curly brace syntax instead of the colon prefix. They are dangerous, as they introduce SQL injection security holes. Applications must strictly control the values passed that way–not accepting user input directly.
2 Likes
That explains a lot and makes a lot of sense. I’ll keep what you said in mind.
Thanks for the help!