Skip to main content
Mr_Henry_M1-Visitor
1-Visitor
July 19, 2019
Solved

Problems with the input parameter in the SQL-query service

Hi!

 

I have a service of SQL-query type, which selects all the data from the table of my Access database. If after From I specify the name of the table, the result is correct. But if I use the input parameter (SCP on the screenshot), in which I enter the same table name when executing the service, the result of operation is Null. What could be the reason?

 

Input parameter.png

 

PaiChungAnswer
22-Sapphire I
July 19, 2019

Input parameter into SQL with [[ ]] are treated as parameters ONLY, you are using it to designate a Table.

You can do this by using << >> which is string substitution.

BUT WARNING - This exposes your data base to SQL string injection!

IE I can specify SCP as 'DROP SCHEMA' and it will drop your schema.

Be sure to always Validate and Secure any Services that use String substitution.

View in thread

1 reply

PaiChung22-Sapphire IAnswer
22-Sapphire I
July 19, 2019

Input parameter into SQL with [[ ]] are treated as parameters ONLY, you are using it to designate a Table.

You can do this by using << >> which is string substitution.

BUT WARNING - This exposes your data base to SQL string injection!

IE I can specify SCP as 'DROP SCHEMA' and it will drop your schema.

Be sure to always Validate and Secure any Services that use String substitution.

Translate
    Terms & ConditionsAccessibility statement