# Dashboard and MS SQL database - number and text input nodes

**URL:** https://discourse.nodered.org/t/dashboard-and-ms-sql-database-number-and-text-input-nodes/55696
**Category:** Dashboard
**Tags:** database
**Created:** [25 December 2021 22:03 UTC](https://discourse.nodered.org/t/dashboard-and-ms-sql-database-number-and-text-input-nodes/55696 "2021-12-25T22:03:14Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)
#### Post date: [25 December 2021 23:07 UTC](https://discourse.nodered.org/t/dashboard-and-ms-sql-database-number-and-text-input-nodes/55696/2 "2021-12-25T23:07:53Z")

</div>

Hi Naz.

Firstly, one thing to realise is that messages NEVER arrive at the same time. So where you have user\_id, first\_name and last\_name linked to a done button - this is never going to work.

Secondly, you risk [sql injection](https://www.imperva.com/learn/application-security/sql-injection-sqli/#:~:text=SQL%20injection%2C%20also%20known%20as,lists%20or%20private%20customer%20details.) by concatinating strings to generate SQL Queries.

To simplify user input and to avoid SQL Injection, use the `ui_form` - it has sends all values entered in one `msg`. Also, use `node-red-contrib-mssql-plus` as it allows you to use parameters (that negate SQL injection)

Example...  
 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/e/2/e247da7d6c8731fc0aac316ae973a237e44052ce.png)

![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/3/6/36e62c906cff18f1dad5736eb27d5bc3bf3fb9b8.png)

![WcueduFvDl](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/a/b/abf89ef898604558995b23f12a3b0a2c42e5e0d6.gif)

* * *

> [@Naz](#):
>
> I am very new to node-red.

I recommend every new user watches this playlist: [Node-RED Essentials](https://www.youtube.com/playlist?list=PLyNBB9VCLmo1hyO-4fIZ08gqFcXBkHy-6). The videos are done by the developers of node-red. They're nice & short and to the point. You will understand a whole lot more in about 1 hour. A small investment for a lot of gain.

---

_[View the full topic](https://discourse.nodered.org/t/dashboard-and-ms-sql-database-number-and-text-input-nodes/55696)._