SqlStatement must be a constant string value. Please use parameters for variable parts to avoid SQL injection

[michielpeeters]

Hi all

I’m rebuilding an existing CFD app that was originally created on 3CX v18. I opened the project in CFD v20 to rebuild it so it will run on v20, but I’m getting this build error:

SqlStatement must be a constant string value. Please use parameters for variable parts to avoid SQL injection.

In v18 the SQL was assembled with an expression like this:

CONCATENATE
Constant string: select * from Centrale.dbo.Phonebook where CLIP like
Varianle: session.ani
Constant string: '
Goal: when a call comes in, look up the caller’s number (ANI) in Centrale.dbo.Phonebook and route accordingly.
Does anybody knows what i have to change to make this work?

 

[Evolute IT]

"WHERE clip LIKE @ani"

In the parameters list, add "ani" and set it to session.ani

 

[edossantos_sipcaller]

And do not use the CONCATENATE function, the SqlStatement must be a constant string.

 

[michielpeeters]

Thanks ConceptsWeb!

i now have the following statement : "SELECT * FROM Centrale.dbo.Phonebook WHERE CLIP LIKE @ani"
and added the parameters:
name: ani
Value: "session.ani"

No more errors while building

 

[edossantos_sipcaller]

Change:
"session.ani"

To:
session.ani

(remove quotes) Otherwise you will pass that text instead of the actual value of the variable.

 

[michielpeeters]

Ok. Thanks i changed it.
Thanks everyone for the helping, much appreciated!

As you can probably tell, my Call Flow Designer knowledge is pretty limited. We only have one customer using it, and we now need to upgrade them to v20, so I’m trying to test as much as possible beforehand.

Quick question: is there any kind of simulator/emulator to test a call flow without deploying it live?

Thanks again!

 

[edossantos_sipcaller]

Quick question: is there any kind of simulator/emulator to test a call flow without deploying it live?

No, you can test it in a test PBX, but must be deployed.