URL report parameter question

[shawn]

I was wondering if this can be done.

See the following SQL statement:

SELECT p.value AS __color__,
   owner AS __group__,
   id AS ticket, summary, component, milestone, t.keywords as "est completion date",   
   t.priority, t.type AS type, time AS created,
   description AS _description_,
   changetime AS _changetime, reporter AS _reporter
FROM ticket t, enum p
WHERE status <> 'closed'
  AND p.name = t.priority AND p.type = 'priority'
  AND t.id in ($TICKETS)
  ORDER BY t.id, t.owner, p.value, t.type, time

I want to pass into $TICKETS something like "1,10,5" without the quotes from a URL reference. Something like this "http://some.site.com/report/5TICKETS=1,10,5". Can it be done?

[anonymous]

Typo… there should be a question mark between the number 5 and TICKETS.

[Matthew Good]

No, this is not supported since putting parameters in unquoted would allow for SQL-injection attacks.

Also, please try the MailingList when asking for support.