For security reasons, Freeform SQL reports using the text prompt feature should use parameterized queries (also called prepared statements) to guard against malicious SQL injections. For data sources that do not support parameterized queries, a redesign of the Freeform SQL reports may be necessary.
The following steps provide an overview for configuring secure Freeform SQL text prompts:
Step 1: Identify database support for parameterized queries
Step 2: Enabling parameterized queries (for supported databases)
Step 3: Define secure Freeform SQL reports (for supported and unsupported databases)
For a full walkthrough, check out the Using Secure Freeform SQL Text Prompts Documentation page.
