You can use the Query action to execute database queries.
You can use placeholders in the query, which are replaced at runtime by a static value or the return of an action.
Syntax: :<param-name>
Example: SELECT * FROM table WHERE col = :value
Options for parameters
You can affect the behavior of the parameter substitution with additional options for the parameters. You can insert the options with square brackets after the parameter name. Example: :<paramname>[<options>] If you want to use several options, you can separate them with a comma.
By default, all parameters are automatically replaced with enclosing quotation marks if required. Numbers and null are inserted without quotation marks. You can use the QUOTES and NO_QUOTES options to control the addition of quotation marks around the parameter values.
-
QUOTES The parameter value, except null, is inserted with quotation marks.
-
NO_QUOTES The parameter value is inserted without enclosing quotation marks. Please note the safety instructions!
The following options are also available:
-
DEFAULT Specifies a value that is used if the parameter value is null.
-
ISEMPTY Specifies a value that is used if the parameter value is empty.
-
ISSTRING Specifies a value that is used if the parameter value is a string.
-
ISNUMERIC Specifies a value that is used if the parameter value is a number.
Example: :param1[QUOTES,ISEMPTY:Default value]
For security reasons, the NO_QUOTES option should be avoided, especially if direct user input is to be transferred to the database.
Using this option can lead to potential SQL injections (attack by injecting SQL commands).
If you use the option anyway, make absolutely sure that the parameter values are validated by the app and masked if necessary to avoid possible security gaps in your app.
Parameters
|
Type |
Name |
Description |
|---|---|---|
|
DATASOURCE |
datasource |
Specifies the data source to be used. |
|
EDITOR |
query |
Defines the query of the database, e.g. in SQL. |
|
KEYVALUELIST |
params |
Specifies a list of parameters to be replaced in the query. |
Return
|
Type |
Description |
|---|---|
|
DATASET |
Returns the result of the query. |