# UserFile BAQ Parameter doesn't work after upgrade

**URL:** <https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640>\
**Category:** Kinetic ERP\
**Tags:** baq\
**Created:** [April 13, 2023, 6:50pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640 "2023-04-13T18:50:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bbockius](https://www.epiusers.help/user_avatar/www.epiusers.help/bbockius/32/932_2.png) [@bbockius](https://www.epiusers.help/u/bbockius)\
**Post date:** [April 13, 2023, 6:50pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640/1 "2023-04-13T18:50:52Z")

</div>

I have a very simple BAQ:

```auto
select 
	[UserFile].[DcdUserID] as [UserFile_DcdUserID],
	[UserFile].[Name] as [UserFile_Name],
	[UserFile].[GroupList] as [UserFile_GroupList]
from Erp.UserFile as UserFile
where (UserFile.DcdUserID = @USERID)

```

 ![image](https://www.epiusers.help/uploads/default/original/3X/7/1/719baead3f3e53f38c709b055ada1c5dfed8e706.png)

It worked on 10.2.700. We upgraded to 2022.1.23, and now it doesn’t. It returns no rows. If I remove the criteria, it returns all rows as one would expect (so I guess not a new security restriction). If I change the parameter to a constant, it works as expected. If I change the = to \<\>, it returns all rows including the USERID. It’s like the Parameter part is corrupting the comparison data for this one table only. (We have hundreds of other BAQs against other tables that seem to be working fine.)

I’ve deleted and reconstructed the BAQ from scratch but no change… Anyone have any suggestions?

Thanks!  
-Bruce

---

<div class="post-metadata">

**Author:** ![ckrusen](https://www.epiusers.help/user_avatar/www.epiusers.help/ckrusen/32/50584_2.png) [@ckrusen](https://www.epiusers.help/u/ckrusen)\
**Post date:** [April 13, 2023, 7:39pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640/2 "2023-04-13T19:39:33Z")

</div>

What happens if you change the operator from “=” to “LIKE”?

If it still comes up empty, try entering `%` when prompted. That work?

Next try entering a known userid preceeded by a `%`, like `%CKRUSEN`. Then try with a trailing `%`, like `CKRUSEN%`. Then one more time with both `%CKRUSEN%`

That’s just to see if there is some sort of leading or trailing character.

---

<div class="post-metadata">

**Author:** ![bbockius](https://www.epiusers.help/user_avatar/www.epiusers.help/bbockius/32/932_2.png) [@bbockius](https://www.epiusers.help/u/bbockius)\
**Post date:** [April 13, 2023, 7:54pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640/3 "2023-04-13T19:54:46Z")

</div>

Changing to LIKE and sending % as USERID returns… nothing ☹

If I change it to the constant ‘%’, it returns all rows, as expected. It really seems like the parameters part is messed up… just in case someone sees something stupid I’m doing:

 ![image](https://www.epiusers.help/uploads/default/original/3X/4/1/41b47aec177356727a997622ea0e6dd7c5836c90.png)

FWIW sending blank in also returns no rows, not what I’d expect with ‘Skip condition if empty’ set.

---

<div class="post-metadata">

**Author:** ![kananga](https://www.epiusers.help/user_avatar/www.epiusers.help/kananga/32/80812_2.png) [@kananga](https://www.epiusers.help/u/kananga)\
**Post date:** [April 13, 2023, 8:15pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640/4 "2023-04-13T20:15:40Z")

</div>

You’ve tripped over unhandled SQL injection. Change your parameter name, `@USERID` is colliding with a software variable or function name.

You can confirm that by making a calculated text field whose value is `@USERID` - but don’t create the parameter with that name. You’ll get your user ID back.

---

<div class="post-metadata">

**Author:** ![bbockius](https://www.epiusers.help/user_avatar/www.epiusers.help/bbockius/32/932_2.png) [@bbockius](https://www.epiusers.help/u/bbockius)\
**Post date:** [April 13, 2023, 8:49pm UTC](https://www.epiusers.help/t/userfile-baq-parameter-doesnt-work-after-upgrade/101640/5 "2023-04-13T20:49:55Z")

</div>

That was it, changed the parameter name to USEREPICORID and all is well now. Thank you very much!