SEC_SQL or Secure SQL VARA objects securely retrieve values from external databases. SEC_SQL VARA objects are similar to SQL VARA objects because they also run SQL statements on an external database. As opposed to SQL VARA objects, with SEC_SQL you can use all supported variables within SQL statements without putting the database at risk of an SQL injection. The variables are replaced regardless of the VAR_SECURITY_LEVEL settings in the UC_SYSTEM_SETTINGS - Systemwide Settings variable.

Important Considerations

Defining SEC_SQL VARA Objects

A SEC_SQL VARA object definition is made up of the following pages:

Defining the Variables Page

  1. In the Variable Settings section, specify the following:

    • Type

      Read-only, always SEC_SQL

    • Connection

      Connection (CONN) object of type Database that contains the connection parameters for the selected database

    • Login

      Login object that stores the name and password of the database user

      If you neither specify a Login object nor set the option Default login, the login data for accessing the database is retrieved from the Connection object.

    • Default Login

      Default Login object that is assigned to your Users (USER) definition.

      If you select this option, the Login object that is specified in the VARA object is ignored.

      An error occurs when resolving the VARA object if no login is defined in the User object.

      PromptSet variables cannot be used here.

    • SQL Statement

      SQL statements used to select specific database entries that serve as variable values.

      Variables that are directly specified in SQL are replaced. To include variables, use bind parameters.

      Maximum length: 4096 characters

      Note: You cannot directly specify the variables ihere, but you can include them using bind parameters. These bind parameters are maintained in the related tables and can include predefined variables, placeholders for VARA objects and PromptSet variables. In the SQL script, use the "?" character in the locations where the bind parameters will be inserted.

  2. You insert variable values within SQL statements in the Bind Parameters section. You can use variable or VARA object names as bind parameters with any values of your choice. If a variable or VARA object does not exist, no values are replaced but the variable or VARA object name is used. This can cause an error when the variable or VARA object is resolved.

    You can enter the following type of variables and VARA objects:

    • Script variables
    • Object variables
    • Predefined variables
    • Predefined and user-defined VARA objects

    Each line in the table represents one bind parameter.

    Supported Data Types and Input Formats

    • Date: yyyy-mm-dd
    • Time: hh:mm:ss
    • Timestamp: yyyy-mm-dd hh:mm:ss
    • String: any string
    • Boolean: possible values: 0 / 1 or true / false
    • Number: no thousand separator, a decimal point as a decimal separator


    • Only the field types and formats previously listed are supported
    • Data types are not converted (no conversion from timestamp to date)
    • Inserting an invalid value causes an error when the SQL commands are processed
    • The VAR_SECURITY_LEVEL variable does not impose any limitations
    • In the SQL statements, you must use a "?" character at every location where the replaced value of a bind parameter should be inserted. A bind parameter must exist for each "?". Ensure that you maintain the correct order (table).
    • You cannot use bind parameters multiple times
  3. Define the Data Types and Formatting.
  4. Define the Script Access.
  5. If you are logged in to Client 0, an additional section is available. For more information, see Client 0 VARA Objects in Other Clients.
  6. To run a command, select it and click Preview. The statements are executed and their results displayed. The preview function serves to check for potential errors in the database statements (for example, it the data type of the VARA object and of the database do not match).

    The database Agent sends the preview data to the Automation Engine in the form of a message. If this message exceeds the maximum message length that a server process accepts, an error occurs.

    Maximum length: Set in the MaxMsgSize= parameter of the Automation EngineUCSRV.INI file.

    Default value: 3145 728 bytes.

  7. Save your changes.

See also: