Skip to main content
BuyLog In
.NET Reporting Tools
Search in…
Docs > WinForms Reporting > Application Security > Custom SQL Query in Report Designer
A newer version of this page is available. .
All docs
V21.2
Reporting
Product Information
Get Started with DevExpress Reporting
Create Reports
Detailed Guide to DevExpress Reporting
Visual Studio Report Designer
WinForms Reporting
Print API
Print Preview
End-User Report Designer
Application Security
Ensure Safe Loading of Reports
Data Access Security
Custom SQL Query in Report Designer
Custom SQL Query Validation
Application Appearance
Application Deployment
Localization
End-User Documentation
WPF Reporting
Web Reporting
WinUI Reporting
WCF Report Service
Discontinued Platforms
Localize Reporting Applications
Redistribution and Deployment
API Reference
ASP.NET Core API Reference
Blazor API Reference
Client API Reference
Client API Reference (Web Forms & MVC)
Download CHM

Custom SQL Query in Report Designer

  • 2 minutes to read

This document describes how to allow users to manually edit SQL queries in the Data Source Wizard of the End-User Report Designer for WinForms.

Important

For security reasons, you should not allow users to edit SQL queries if your reporting application can be accessed by untrusted parties. Refer to the following topic for more information: Data Access Security.

How to Enable Custom SQL

Do the following to allow users to edit SQL queries:

  1. Select the Report Designer’s XRDesignMdiController in the component tray.

    winforms-report-designer-select-mdi-controller-ribbon

  2. In the Properties window, expand the XRDesignMdiController.SqlWizardSettings complex property and set the SqlWizardSettings.EnableCustomSql property to true.

    winforms-report-designer-enable-custom-sql

    The following warning appears before you change the EnableCustomSql property value:

    winforms-report-designer-enable-custom-sql-warning

SQL Editing Enabled in Query Editor

  1. Load a report in the Report Designer, or create a new report bound to the SQL data source. In the Report Explorer window, select Manage Queries:

    winforms-report-designer-manage-queries

  2. In the Manage Queries window, click the ellipsis button to edit the selected query:

    winforms-report-designer-manage-queries-window

  3. You can manually edit the query in the invoked Query Editor window:

    winforms-report-designer-query-editor-edit-sql-window

  4. If you enter a non-select query, the following error is displayed when you click Next:

    winforms-report-designer-custom-sql-query-validation-warning

SQL Editing Enabled in Query Builder

Invoke the Data Source Wizard and navigate to the query creation page. On this page, click the report-wizard-multi-query-page-icon-add button for the Queries category to create a new query using the Query Builder.

report-wizard-invoke-query-builder

The Allow Edit SQL option is now available in the Query Builder. If a user switches to this mode, the visual features of the Query Builder are disabled in favor of the specified SQL string value.

eud-query-builder-custom-sql

Important

Custom SQL queries are validated before their execution.

Although the default validation mechanism only allows custom queries containing SELECT statements (except for SELECT INTO clauses), it cannot be considered safe as it does not prevent execution of potentially harmful requests.

For this reason, we strongly recommend that you implement your own validation logic that permits only execution of specific query kinds.

See the following topic to learn more: Provide Custom Query Validation in Report Designer.

See Also