Discussions
Categories
Groups
Community Home
Categories
INTERNAL ENABLEMENT
POPULAR
PUBLIC CLOUD
PRIVATE CLOUD
Quick Links
MY LINKS
HELPFUL TIPS
Back to website
Home
Intelligence (Analytics)
Query by URL
Netzio
Hello,
Is there a way to send the URL Birt through complete a QUERY or a complete WHERE several conditions.
Thank
Find more posts tagged with
Comments
johnw
Yes, you can use report parameters and set them in the Property Binding tab. Not sure that you'd want to influence the query directly, however, due to opening up your database to SQL injection.<br />
<br />
John<br />
<br />
<blockquote class='ipsBlockquote' data-author="'Netzio'" data-cid="66150" data-time="1278362072" data-date="05 July 2010 - 01:34 PM"><p>
Hello,<br />
<br />
Is there a way to send the URL Birt through complete a QUERY or a complete WHERE several conditions.<br />
<br />
Thank<br /></p></blockquote>
Netzio
<blockquote class='ipsBlockquote' data-author="'johnw'" data-cid="66235" data-time="1278564173" data-date="07 July 2010 - 09:42 PM"><p>
Yes, you can use report parameters and set them in the Property Binding tab. Not sure that you'd want to influence the query directly, however, due to opening up your database to SQL injection.<br />
<br />
John<br /></p></blockquote>
<br />
Thanks for answering but do not understand, can you explain in more detail ...<br />
<br />
thanks in advance
johnw
What you would have is a report parameter called employeeID.
In your dataset, you would write a query like so:
select
*
from
employees;
Then in the dataset editor, you would go to the Property binding tab, and in the Query Expression text box (which overrides the data sets query at runtime), you would write an expression like:
////////////////////////////////
var sql;
if (params["employeeID"] != null)
{
sql = "select * from employees where empID = " + params["employeeID"];
//return sql as the expression result
sql;
}
///////////////////////////////
What this would do is if the user passes in an employee id parameter, it would override the basic query in the data set and replace it with the more advanced query in the Property binding tab. This works great, unless the users passes in a parameter value of "1; drop table employees;". Then, it will delete the employees table in addition to querying it. This is called SQL injection. So unless you are in a trusted environment, or have removed the appopriate privileges on the underlying database, this could be a potential security issue.
Netzio
Thanks
and this as I do as I am sending these values from the URL
if I want to send
ID = 102 AND OT = 14
through as this parameter is the URL?
as is his Syntaxis?
http://localhost:8080/birt-viewer/frameset?__report=TestQueryDynamic.rptdesign
(and that)
As does the Birt Viewer to send the parameters of that Syntaxis to Birt?
johnw
You would create two report parameters, 1 called id, the other called ot.
In your property binding tab, the expression would look like:
/////////////////////////////
sql = "select * from employees where id = " + params["id"] + " and ot = " + params["ot"];
sql;
/////////////////////////////
You would then call the report like:
http://localhost:8080/birt-viewer/frameset?__report=TestQueryDynamic.rptdesign&id=idNumber&ot=otNumber
Netzio
Mate,
What works if you offer me, but not what I need ...
I happen to liability must complete an expression Birt
ACTIVO=1 AND (ID_PERFIL=15 OR ID_PERFIL=12...)
not independent parameters, so was wondering how do Birt, as I in the text entry box and the full expression (Birt) does so without any problem.
as it does?
where to send the values that entry into the text box Birt?
http://www.freeimagehosting.net/image.php?536728f1d4.jpg
http://www.freeimagehosting.net/image.php?b96e8715bd.jpg
maybe a couple of pictures I need clarification ...
Thanks very much
johnw
Same concept applies. Except your Property Binding will look like:
///////////////////
sql = "select * from employees";
if ((param["prmExp1"] != null) && (param["prmExp1"]))
{
sql = sql + " where " + param["prmExp1"];
}
sql;
//////////////////
so instead of passing in a single parameter value, your passing in the entire where clause.
Netzio
Friend tell me what you already know ...<br />
<br />
my question is another ...<br />
<br />
It's like pass these parameters from Visual Basic to Birt below<br />
Birt viewer as it does to receive these parameters<br />
<br />
from the text box to the reporting engine.<br />
<br />
I know how to make the script, as declaring parameters, etc..<br />
<br />
I only need to pass this expression from Visual Basic to Birt ...<br />
<br />
if an integer value would<br />
<pre class='_prettyXprint _lang-auto _linenums:0'>
Dim NameParam as Integer = TextBox1.value
"URL&prmNombre=" + NameParam
</pre>
<br />
but as I do with an expression that is not an integer value but a complete expression, this is problematic.<br />
<br />
<br />
believe me I will not intrude, just solve my problem ....<br />
<br />
<br />
Thanks
johnw
I'm not sure if we are having a communication breakdown or not.<br />
<br />
If I understand correctly, you want to pass a whole expression in and modify the query with that expression, correct?<br />
<br />
<blockquote class='ipsBlockquote' data-author="'Netzio'" data-cid="66296" data-time="1278681014" data-date="09 July 2010 - 06:10 AM"><p>
Friend tell me what you already know ...<br />
<br />
my question is another ...<br />
<br />
It's like pass these parameters from Visual Basic to Birt below<br />
Birt viewer as it does to receive these parameters<br />
<br />
from the text box to the reporting engine.<br />
<br />
I know how to make the script, as declaring parameters, etc..<br />
<br />
I only need to pass this expression from Visual Basic to Birt ...<br />
<br />
if an integer value would<br />
<pre class='_prettyXprint _lang-auto _linenums:0'>
Dim NameParam as Integer = TextBox1.value
"URL&prmNombre=" + NameParam
</pre>
<br />
but as I do with an expression that is not an integer value but a complete expression, this is problematic.<br />
<br />
<br />
believe me I will not intrude, just solve my problem ....<br />
<br />
<br />
Thanks<br /></p></blockquote>
Netzio
<blockquote class='ipsBlockquote' data-author="'johnw'" data-cid="66316" data-time="1278759147" data-date="10 July 2010 - 03:52 AM"><p>
I'm not sure if we are having a communication breakdown or not.<br />
<br />
If I understand correctly, you want to pass a whole expression in and modify the query with that expression, correct?<br /></p></blockquote>
<br />
Exactly, this is possible ...<br />
<br />
... The Birt Viewer makes it through his window parameters, as I can do it by code ...<br />
<br />
Thanks
Netzio
<blockquote class='ipsBlockquote' data-author="'Netzio'" data-cid="66336" data-time="1278939170" data-date="12 July 2010 - 05:52 AM"><p>
Exactly, this is possible ...<br />
<br />
... The Birt Viewer makes it through his window parameters, as I can do it by code ...<br />
<br />
Thanks<br /></p></blockquote>
<br />
<br />
Indeed it is possible<br />
- In Internet Explorer go to tools> advanced and check the box Always send URLs as UTF-8<br />
<br />
- Create a report parameter of type string<br />
<br />
- In ASP.NET add the following code ...<br />
<br />
<br />
function GenerarReporte()<br />
{ <br />
<br />
nombreReporte = "rptOts.rptdesign";<br />
param = "&prmExp1=" + document.frmTestReport.txtExpFiltroSql.value; <br />
showModalDialog("<a class='bbc_url' href='
http://localhost:8080/birt-viewer/frameset?__report="+'>http://localhost:8080/birt-viewer/frameset?__report="+</a>
; nombreReporte + param,null,"scroll:No;status:no;center:yes;help:no;minimize:no;maximize:no;border:thin;statusbar:no;dialogWidth:900px;dialogHeight:600px"); <br />
<br />
}<br />
<br />
<br />
txtExpFiltroSql contains the expression (field = value and (field = value or field = value)) complete with brackets entered by screen.<br />
<br />
Thanks to User <strong class='bbc'>foolcatjr</strong> I indicated the issue of UTF-8...
