This topic is locked
[SOLVED]

 Custom Query from front-end

3/20/2020 11:40:39 AM
PHPRunner General questions
S
sadisticmagician author

Hello,

sometime users need to make complex query so become difficult to use panel or advanced search filter.

Is possible run a SQL query from front-end directly?
thanks

Admin 3/21/2020

While this is possible there are a few issues there. Certainly, you can add a large text field somewhere on the page where users can enter the SQL query.
However, how do you prevent them from entering the SQL query that will delete some data?
Also, how do you display the results, if they change the list of fields in the SQL query.
Probably your best option is to let them enter the WHERE clause only and then add it to your query using the technique, explained in this article:

https://xlinesoft.com/phprunner/docs/dynamic_sql_query.htm

S
sadisticmagician author 3/26/2020



While this is possible there are a few issues there. Certainly, you can add a large text field somewhere on the page where users can enter the SQL query.
However, how do you prevent them from entering the SQL query that will delete some data?
Also, how do you display the results, if they change the list of fields in the SQL query.
Probably your best option is to let them enter the WHERE clause only and then add it to your query using the technique, explained in this article:

https://xlinesoft.com/phprunner/docs/dynamic_sql_query.htm


Hello thank you for help.
"However, how do you prevent them from entering the SQL query that will delete some data?"
No is not possible, because my internal operators don't know mysql language.

I will create the query for them, and they will only have to insert.

So is possible create a text area for launch a custom query?
The second way, does it allow me to insert the textarea?
thanks

Admin 3/27/2020

They may not know SQL but it will take one idiot to google some SQL commands and delete all the data.
Also, if you are creating SQL commands for them you do not need the text area, you can just use some sort of a dropdown box for this purpose. Or you can even use built-in Saved Searches option.
In either case - you can output the text area control or a dropdown control using 'Insert PHP code snippet' functionality.

S
sadisticmagician author 3/27/2020



They may not know SQL but it will take one idiot to google some SQL commands and delete all the data.
Also, if you are creating SQL commands for them you do not need the text area, you can just use some sort of a dropdown box for this purpose. Or you can even use built-in Saved Searches option.
In either case - you can output the text area control or a dropdown control using 'Insert PHP code snippet' functionality.


ok thank you very much <img src='https://asprunner.com/forums/file.php?topicimage=1&fieldname=reply&id=90662&image=1&table=forumreplies' class='bbc_emoticon' alt=':)' />