# Best Practices for hardening field names in ExecuteSQL

**URL:** <https://the.fmsoup.org/t/best-practices-for-hardening-field-names-in-executesql/3147>\
**Category:** Questions\
**Tags:** sql, executesql\
**Created:** [October 12, 2022, 1:49pm UTC](https://the.fmsoup.org/t/best-practices-for-hardening-field-names-in-executesql/3147 "2022-10-12T13:49:25Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![mipiano](https://yyz2.discourse-cdn.com/flex030/user_avatar/the.fmsoup.org/mipiano/32/1074_2.png) [@mipiano](https://the.fmsoup.org/u/mipiano)\
**Post date:** [October 13, 2022, 7:13am UTC](https://the.fmsoup.org/t/best-practices-for-hardening-field-names-in-executesql/3147/3 "2022-10-13T07:13:44Z")

</div>

The following is part of the [Typinator set](https://the.fmsoup.org/t/automatically-open-data-viewer/3128/11) that I got from Matt Petrowsky or [filemakerstandards.org](http://filemakerstandards.org):

```auto
Let ( [ ~sql = "
	SELECT t1.~field
	FROM ~table1 t1
	JOIN ~table2 t2
	ON t1.~field = t2.~field
	WHERE ~field LIKE '%~value%'
	AND ~field=?
	ORDER BY ~field";

	$sqlQuery = Substitute ( ~sql ;
		["~table1" ; SQLTableName ( Table1::fieldName )];
		["~table2" ; SQLTableName ( Table2::fieldName )];
		["~field" ; SQLFieldName ( Table1::fieldName )];
		["~value" ; Table::field]
	);

	$sqlResult = ExecuteSQL ( $sqlQuery ; "" ; "" ;
    	$value;
    	$value[2];
    	$value[$n]
	)
];
	//Substitute ( $sqlQuery ; "	" ; "" ) &¶& // sql preview
	If ( $sqlResult = "?" ;
		Let ( ~debug = False ; If ( ~debug ; SQLDebugResult ( $sqlResult ) ; False ) );
		$sqlResult
	)
)

```

The Custom Functions SQLTableName and SQLFieldName get the table name part or the field name part of a full field name.  
A great use case for text expansion tools like Typinator.

---

_[View the full topic](https://the.fmsoup.org/t/best-practices-for-hardening-field-names-in-executesql/3147)._