I have an MS SQL query where I am trying to pass in the value of a checkbox group into it.
Select * from Calls
Where name IN ( {{ checkboxGroup1.value }} )
The value from the checkbox is 'Roadside CC' but if there are two value the SQL no longer works.
I have a javascript query that reformats the values from the checkboxgroup.
let selectedValues = checkboxGroup1.value;
let formattedValues = "'" + selectedValues.join("', '") + "'";
return formattedValues; // Outputs a string like 'value1', 'value2', 'value3'
the result of this = "'Roadside CC', 'Priority CC'"
I believe the issue is with the " double quotes.
Has anyone gotten this to work for using dynamic conditions?
Hey @tbommer, by default, all of our SQL queries are converted to prepared statements to prevent SQL injection which is why you're seeing the double quotes issue. The main reason we currently convert all statements into prepared statements is so that users can't enter malicious syntax (like DROP TABLE) into the variable fields. If you have a static list of checkbox's, I'd recommend accessing them via something like Where name IN ({{checkboxGroup1.value[0]}, {{checkboxGroup1.value[1]}).
If this doesn't work for you, you can disable converting queries to prepared statements in the resource setup, but keep in mind the potential of submitting dangerous SQL through any of the variables referenced in a query. Disabling prepared statements can also break other existing queries. If that's something you'd like to explore, I often recommend setting up another copy of a resource with that setting enabled to help limit the surface area that you have to keep in mind SQL injection for.
