Intent: define. An athletic awards database prepared statement policy is a data-governance document that specifies which database query types in a school’s recognition system must use parameterized execution—commonly called prepared statements—rather than dynamically assembled SQL strings. The policy defines the query construction standards for searches, exports, bulk updates, and administrative forms that touch award, athlete, and season records; identifies the categories of dynamic input that require parameterization; establishes authorization for any exceptions; and sets logging and review requirements for queries that handle user-supplied values.
The short answer: classify every query interface in your recognition system by whether it accepts user-supplied input, and require parameterized execution for every query that does. Queries built by concatenating user input directly into SQL strings are vulnerable to SQL injection—an attacker who controls the input string can rewrite the query to extract, modify, or delete award records, athlete profiles, and administrative credentials. Parameterized queries prevent this class of attack by separating the query structure from the data values, so user-supplied input is always treated as data, never as executable SQL.
This guide defines prepared statements in plain language, presents a safe-versus-unsafe query classification table for athletic recognition contexts, maps the specific failure scenarios that a prepared statement policy prevents, provides a policy framework with a five-area governance structure, and delivers a seven-step implementation review checklist for IT administrators assessing or improving prepared statement coverage across an existing recognition database.
An athletic director opens the school’s award search interface, types a sport name into the filter field, and clicks Search. Behind that click, a query runs against the recognition database. If that query was built by appending the sport name directly to a SQL string, then anyone who types ' OR '1'='1 into the sport field instead of a real sport name can rewrite the query’s logic—potentially returning every record in the database, bypassing access controls, or exposing athlete records the searcher was never authorized to see.
This is not a theoretical risk. SQL injection has been among the Open Web Application Security Project’s (OWASP) top ten application security risks for more than two decades, consistently appearing in the top three categories affecting database-driven web applications. Prepared statements—also called parameterized queries—are the primary defense, and they are available in every major database platform and application framework that recognition systems use.
An athletic awards database prepared statement policy is the governance document that converts this defense from a best-effort coding habit into an enforced, auditable standard.
Recognition kiosks that accept user input—sport filters, name searches, season selectors—execute database queries against award and athlete records; a prepared statement policy ensures those queries are structured so user input cannot alter query logic
What Is a Prepared Statement? A Definition for Athletic Program Administrators
A prepared statement is a database query that is defined with a fixed structure and explicit placeholders for input values, then compiled by the database engine before any user-supplied data is inserted. When the query executes, the user’s input is passed separately from the query text—the database engine inserts it as a typed data value, not as part of the SQL command itself.
The alternative—dynamic SQL construction—builds the query text by concatenating strings at runtime:
SELECT * FROM awards WHERE sport = '" + userInput + "'"
If userInput contains SQL syntax (a single quote, a semicolon, a comment marker), the database receives a query with altered logic rather than a data filter. Prepared statements eliminate this possibility:
SELECT * FROM awards WHERE sport = ?
The ? placeholder (or $1, :sport, or a named parameter depending on the platform) is compiled into the query structure before execution. When the value is bound, the database treats it as a string literal to compare against the sport column—regardless of what characters it contains.
For IT administrators maintaining athletic recognition databases, the practical consequence is predictability: a prepared statement executes the same query plan every time it runs for the same input shape, which improves query performance through plan caching in addition to preventing injection. According to the NIST National Vulnerability Database, SQL injection vulnerabilities carry a Common Vulnerability Scoring System (CVSS) base score that frequently reaches 9.8 out of 10—critical severity—because they can allow complete database compromise with no authentication required.
Safe vs. Unsafe Query Patterns in Athletic Recognition Databases
The following table classifies common query construction patterns used in award search, export, and update workflows:
| Query Pattern | Classification | Risk Level | Notes |
|---|---|---|---|
| Parameterized query with typed placeholders | Safe | None | Database treats all input as data; injection is structurally impossible |
| ORM query builder with bound parameters | Safe | None | Well-maintained ORMs (SQLAlchemy, ActiveRecord, Hibernate) parameterize by default |
| Stored procedure with input parameters | Safe (if internally parameterized) | None | Stored procedures that use parameterized internal queries prevent injection |
| String concatenation with user input | Unsafe | Critical | Input can rewrite query logic; primary injection vector |
LIKE '%' + userInput + '%' without parameterization | Unsafe | Critical | Wildcard search is a common injection entry point in name-search fields |
| Dynamic column name from user input | Unsafe | High | Column names cannot be parameterized; must be validated against an allowlist |
| Dynamic table name from user input | Unsafe | High | Table names cannot be parameterized; must be validated against an allowlist |
| Integer cast without validation | Moderately risky | Medium | Casting to integer prevents string injection but does not validate range or format |
| Stored procedure that builds internal dynamic SQL | Unsafe | High | The stored procedure boundary does not protect against internal string concatenation |
| Escaping library applied to concatenated input | Conditionally safe | Medium | Escaping reduces risk but is error-prone; parameterization is preferred over escaping |
The distinction between column/table name handling and value handling is important for award search interfaces that allow users to sort results by column. Column and table names cannot be passed as parameters in any major SQL database—the database engine processes them as structural elements, not data. Any interface that accepts a sort-by-column choice from user input must validate that value against a hardcoded allowlist of permitted column names before including it in the query, and must never concatenate it directly without validation.
How SQL Injection and Query Instability Surface in Athletic Recognition Programs
Three failure patterns appear consistently when an athletic recognition database lacks a prepared statement policy.
Award search interface injection via sport or athlete name fields. A web-based award search that accepts an athlete name or sport category as free-text input and concatenates it into a WHERE clause is the most common injection surface in athletic recognition systems. An attacker who knows the input is being concatenated can use the name field to extract all records, modify award data, or enumerate administrative accounts. For a high school recognition database containing personally identifiable information about student athletes, this constitutes a student data breach under FERPA and applicable state privacy regulations.
Export form injection via season or date range filters. Recognition programs that offer bulk data exports—end-of-season award lists, historical records for archive submission, governing body reporting—frequently provide filter forms with season-year dropdowns, date range inputs, or category checkboxes. If the values from those controls are concatenated into the export query rather than bound as parameters, a malformed or manipulated form submission can return data beyond the intended scope. An export that was intended to return one season’s football records can be rewritten to return all records in the database.
Unstable query plans from repeated ad-hoc queries. Beyond security, unprepared dynamic SQL degrades performance and predictability in recognition databases that serve display interfaces. Each unique SQL string a database engine receives is compiled separately. A search form that generates a slightly different SQL string for each variation in user input—because column names, sort directions, or filter combinations are concatenated differently each time—prevents the database engine from caching and reusing query plans. Prepared statements allow the engine to compile once and reuse, which is measurable at scale: IBM’s Db2 documentation notes that prepared statement plan reuse can reduce query compilation overhead by 50–90% for repeated query patterns on high-traffic systems.
For programs managing recognition data alongside broader school information assets, the academic recognition programs guide at touchscreenrecognition.com describes the full data management lifecycle for school recognition records—the same query security principles that apply to athletic award searches apply to academic honor records, scholarship data, and student achievement exports.
Athletic records displayed in school hallways are drawn from databases through filter and search queries — a prepared statement policy ensures that every query interface, from admin forms to API endpoints, parameterizes user input rather than concatenating it into SQL
Core Components of an Athletic Awards Database Prepared Statement Policy
An effective prepared statement policy for athletic recognition programs addresses five governance areas.
1. Query Construction Classification by Interface Type
The policy must classify every query interface in the recognition system as one of three categories:
Static queries — queries with no user-supplied input (scheduled reports, nightly display refresh queries, automated export jobs). These queries carry no injection risk and require no special parameterization handling beyond ensuring that their static values remain hardcoded in the query definition rather than assembled from configuration files that could be modified.
Parameterized queries — queries that accept user-supplied values as filter criteria, sort directions, or limit values. These represent the standard interface type for award search, athlete lookup, season filter, and category selector forms. All must use prepared statements with typed parameter binding.
Dynamic structural queries — queries where the structure itself changes based on user choice: dynamic column selection (the user picks which columns appear in an export), dynamic sort column (the user clicks a column header to re-sort results), or multi-condition filters assembled from checkbox selections. These require allowlist validation of all structural elements before query assembly, and must be reviewed individually during policy implementation because parameterization alone is insufficient.
The policy should require that every query interface be classified before deployment and that the classification be documented in a query registry maintained by the IT administrator. New query interfaces added during platform updates must be classified before release.
2. Parameter Type Validation Before Execution
Parameterized queries pass user input as typed values—but the type must be enforced before binding, not assumed after. The policy must specify that application-layer validation precedes parameter binding for every input:
| Input Type | Required Validation Before Binding |
|---|---|
| Athlete name (string) | Maximum length; strip leading/trailing whitespace; reject null bytes |
| Season year (integer) | Numeric type assertion; range check (1900 to current year + 1) |
| Sport category (string) | Allowlist match against recognized sport names in the recognition system |
| Date range (date) | ISO 8601 format validation; start-date must precede end-date |
| Award category ID (integer) | Numeric type assertion; existence check against award category table |
| Sort direction (string) | Allowlist: ASC or DESC only; reject all other values |
| Export format (string) | Allowlist: csv, xlsx, json; reject all other values |
This two-layer approach—parameterization plus pre-binding validation—prevents a class of attacks that target type confusion: a form field that expects an integer year can still cause unexpected behavior if it receives a very large number or a negative value, even when parameterized. Pre-binding validation catches these edge cases at the application layer before they reach the database.
3. Authorization Scope for Dynamic Query Construction
Some administrative functions in athletic recognition systems legitimately require dynamic query construction: a bulk export that lets the athletic director choose which columns to include, a reporting interface that assembles multi-table joins based on selected award types, or an import validation query that checks for duplicates across variable field combinations. The policy must define who is authorized to build queries with dynamic structural elements, and under what conditions.
Recommended authorization framework:
| Query Type | Who May Execute | Required Safeguard |
|---|---|---|
| Standard parameterized award search | All recognition coordinator accounts | Prepared statement with typed parameters |
| Dynamic column export (user-selected fields) | Recognition coordinators with export permission | Column name allowlist validation; no raw user input in query structure |
| Dynamic table join (multi-type export) | IT administrator or recognition administrator | Server-side join definition; column and table names never from user input |
| Administrative bulk update with condition builder | IT administrator only | Peer review of query before execution; audit log entry |
| Direct database console query | IT administrator only | Not permitted through application interfaces; database console access only |
The authorization matrix should be reviewed annually and updated when new query interfaces are added to the recognition system or when staff roles change. Any exception to the prepared statement requirement—a case where a dynamic query cannot practically be parameterized—must be documented with the specific technical reason, approved by the IT administrator, and scheduled for remediation at the next development cycle.
4. Audit and Logging Requirements
The policy must define what is logged for each query category. Logging serves two purposes: security incident investigation (identifying when a query behaved unexpectedly or was used to extract unauthorized data) and performance monitoring (identifying queries that are candidates for optimization through plan caching or index adjustment).
Required log fields for parameterized query execution:
- Timestamp with millisecond precision
- Query identifier from the query registry (not the raw SQL text, which may contain sensitive values)
- User account that initiated the query (for web interfaces, the authenticated session user; for batch jobs, the service account)
- Parameter count and types (not the parameter values; logging parameter values may expose PII for athlete name queries)
- Execution time in milliseconds
- Row count returned or affected
- Error class if the query fails, with the database error code
For interfaces that accept administrative input—bulk updates, import validation, export configuration—log the parameter count and types at query construction time in addition to execution time. This creates a record of what the interface was asked to do before execution, which is useful when investigating unexpected query outcomes.
5. Platform and Framework Compliance Requirements
The policy must specify which database driver, ORM, or query builder the recognition system is permitted to use, and confirm that each supports native parameterized query execution.
| Platform | Prepared Statement Mechanism | Notes |
|---|---|---|
| PostgreSQL | $1, $2 positional parameters; psycopg2 (Python), pg (Node.js), pgx (Go) | Native support; plan caching via PREPARE/EXECUTE |
| MySQL / MariaDB | ? positional parameters; mysql2 (Node.js), MySQLi (PHP) | Native support; server-side prepare requires explicit flag in some drivers |
| Microsoft SQL Server | @param named parameters; pyodbc, mssql (Node.js) | Native support; use sp_executesql for server-side prepared statements |
| SQLite | ? or ?NNN positional; sqlite3 (Python), better-sqlite3 (Node.js) | Native support; prepared statements improve performance on repeated queries |
The policy should prohibit use of query construction libraries that do not support native parameterization, regardless of whether those libraries are otherwise functional. Recognition system code reviews should include explicit verification that query construction uses the parameterization API of the approved library—not string formatting functions applied to the query text.
For programs evaluating recognition platforms that manage their own database layer, the academic recognition programs guide at halloffametouchscreen.com discusses how recognition platforms handle data management for diverse award types—a vendor should be able to confirm that their platform uses parameterized queries throughout the application tier, including for search, export, and import validation interfaces.
Administrators who rely on recognition displays for accurate award information need assurance that the queries serving those displays are structurally safe — a prepared statement policy provides that assurance through enforceable standards, not informal coding habits
Seven-Step Implementation Review Checklist
For IT administrators assessing prepared statement coverage across an existing athletic recognition database, the following checklist provides a structured audit-to-remediation path.
Step 1: Build a Query Interface Inventory
List every interface in the recognition system that executes a database query, including web search forms, API endpoints, scheduled export jobs, administrative bulk update tools, import validation routines, and display refresh queries. For each, record the query type (select, insert, update, delete), the tables accessed, whether the interface accepts user-supplied input, and the current query construction method (parameterized, concatenated, ORM). This inventory becomes the query registry referenced in the policy’s audit logging section.
Step 2: Identify All User Input Entry Points
For each query interface that accepts input, trace every path by which user-controlled data can reach the query. In web forms this is straightforward—form fields map to query parameters. In API endpoints, review query string parameters, request body fields, headers used in filtering, and session attributes applied to queries as access control conditions. In scheduled jobs, identify configuration files or database tables from which the job reads runtime parameters, and determine whether those sources could be modified by an unprivileged user. Any path by which user-controlled data reaches a query is an injection surface.
Step 3: Classify Each Query Using the Safe/Unsafe Table
Apply the classification framework from the Safe vs. Unsafe Query Patterns section to each query interface in the inventory. Mark each as safe (parameterized), unsafe (concatenated), or dynamic structural (requires allowlist validation rather than parameterization). For each unsafe or unreviewed dynamic structural query, create a remediation record that includes the specific code location, the type of injection risk, the interface that exposes the query, and the sprint or milestone by which remediation must be complete.
Step 4: Remediate Unsafe Queries in Priority Order
Address unsafe queries in order of exposure risk: public-facing search and filter interfaces first, then authenticated internal interfaces, then batch and scheduled jobs. For each unsafe query, replace string concatenation with the parameterized query API of the approved driver or ORM. For dynamic structural queries (sort column, export column selection), replace user input in the query structure with allowlist-validated structural values. Document each remediation with the commit reference and a note in the query registry marking the interface as reviewed and safe.
For programs seeking reference implementations of how recognition data is structured across award types that map to individual query interfaces, the 10 best hall of fame tools for athletics, donors, arts, and history at best-touchscreen.com describes the data categories that recognition platforms manage—each category represents a query surface that the prepared statement policy must cover.
Step 5: Test Each Remediated Interface Against Injection Payloads
After remediating each interface, test it against a standard set of injection payloads before returning it to production. Testing confirms that parameterization is implemented correctly, not just that the code was modified. Use a small, documented test suite:
- Single-quote injection: input
' OR '1'='1in every string field - Semicolon injection: input
'; DROP TABLE awards; --in string fields - Comment-based bypass: input
' --and'/*to test comment-based logic alteration - Integer overflow: input
99999999999and-1in integer fields expected to hold season years or IDs - Null byte injection: input strings containing
\x00characters to test null-byte handling - Allowlist bypass: for sort-column and export-column fields, input column names not on the allowlist and confirm rejection
Document the test results for each interface. A remediated interface that passes all test cases moves from the remediation queue to the safe inventory. An interface that fails any test case returns to the remediation queue with the specific failure documented.
Step 6: Implement Query Logging at Required Fields
Update the recognition system’s logging infrastructure to emit the structured log entries defined in the policy’s audit logging section for every parameterized query execution. Use a structured log format—JSON entries or a structured logging library—so that log analysis tools can query the log by user account, query identifier, or execution time without parsing free-text messages. Confirm that logs are written to a durable store with appropriate retention: FERPA-covered student data systems should retain access logs for a minimum period consistent with the institution’s records retention policy, typically two to seven years.
For programs managing recognition data within a broader school information architecture, the academic decathlon recognition guide at digitalwalloffame.com describes the data completeness and auditability requirements for academic achievement recognition—the same logging standards that support academic recognition auditability apply to athletic award data managed under the same institutional information governance framework.
Step 7: Schedule Annual Policy Review and Penetration Test
Prepared statement coverage must be maintained as the recognition system evolves. New features add new query interfaces; platform updates may change the query construction APIs available. Schedule an annual review of the query interface inventory against current application code to confirm that new interfaces were classified and remediated before release. Include parameterized query verification in the code review checklist for any pull request that adds or modifies a database query.
For programs that include the recognition database in an annual security assessment, verify that the penetration testing scope explicitly includes SQL injection testing against award search, export, and administrative interfaces—not only network-layer and authentication tests. SQL injection testing against parameterized queries should confirm that the parameterization is present in the deployed application, not only that the development code was reviewed.
Every athlete card on a recognition display is fetched by a query — the prepared statement policy governs how those queries are constructed to ensure that user-supplied filter values cannot alter query logic or expose unauthorized records
When Static Queries and Allowlists Are Sufficient
A prepared statement policy must be equally clear about where parameterization applies and where other safeguards are appropriate.
Scheduled display refresh queries with no user input. A nightly job that re-exports the current season’s award records to a display cache runs the same query every time with hardcoded season and category values. There is no user input to parameterize. The safeguard for this case is ensuring that the static query text is stored in version-controlled application code, not in a configuration table that could be modified by an application-layer user. Parameterization adds no security benefit here; source control and deployment discipline do.
Allowlist-validated sort column and export column selection. A user interface that lets a coordinator choose which columns appear in an award export cannot parameterize the column names—column names are structural SQL elements, not data values. The correct safeguard is an allowlist: the application defines the complete set of permitted column names, maps each UI choice to a specific allowlist entry, and assembles the query using only those validated values. Any input that does not match an allowlist entry is rejected before query construction. The allowlist itself must be maintained in application code, not derived from user input or a user-accessible database table.
ORM query builders with automatic parameterization. Many recognition system frameworks use ORMs that parameterize queries automatically when using their standard query builder APIs. If the ORM’s query builder is used correctly—using methods like .where(sport: userInput) rather than .where("sport = '#{userInput}'")—parameterization is handled by the framework. The policy should confirm which ORM methods are safe and which allow raw string interpolation, and require that code reviews verify correct ORM usage patterns rather than only checking for explicit string concatenation.
For programs evaluating how recognition platforms handle data integrity across their full digital recognition ecosystem—from import pipelines to display outputs—the AI data integrity advisory for the digital hall of fame market at rocketgraphics.ai discusses how platform architecture choices affect long-term data security and reliability for school recognition programs. Query security is a platform procurement criterion worth evaluating alongside data import handling and display integration.
Display Integration: How Prepared Statement Policy Affects Recognition Output Quality
Three principles connect prepared statement governance to the quality and reliability of public-facing recognition outputs.
Principle 1: A parameterized query always returns what the filter logic specifies. When award search and filter queries are parameterized, the results reflect the actual filter criteria—sport name, season year, award category—without any possibility that user input has altered the underlying query logic. Staff who rely on filtered views of award records for ceremony preparation, governing body reporting, or historical archive submission can trust that the query returned the records the filter was designed to select.
Principle 2: Plan caching from prepared statements improves display response time. Recognition displays that execute repeated award queries—fetching records for a specific sport, refreshing an inductee list, loading portrait cards for a lobby kiosk—benefit from the query plan caching that prepared statements enable. The database engine compiles the parameterized query once per session and reuses the plan for subsequent executions with different parameter values. For interactive kiosk displays that respond to visitor touch input, this response-time improvement is directly visible in the user experience.
Principle 3: Consistent query behavior supports reliable export pipelines. Award record exports that feed downstream systems—archive platforms, print vendors, governing body reporting portals—depend on queries that return predictable result sets. A parameterized export query with validated date range and category parameters will return the same records for the same input every time it runs, allowing staff to verify export completeness by comparing row counts across runs. A dynamic SQL export query that assembles differently based on input variation or environmental state is harder to verify and harder to diagnose when results are unexpected.
For programs that recognize achievement milestones at significant events and anniversaries—including multi-year class reunions and recognition ceremonies described in the 10-year high school reunion ideas and awards programming guide at digitalawardsdisplay.com—the integrity of the award records displayed at those events depends on query pipelines that consistently retrieve the right records. Prepared statement governance is part of the infrastructure that makes recognition displays trustworthy at moments that matter to alumni and families.
For programs building or evaluating recognition infrastructure with an eye toward long-term data quality, the best hall of fame tools overview at digitalwarming.net reviews the data management and display capabilities of recognition platforms—including the data access patterns that a prepared statement policy must govern.
Recognition walls depend on database queries that reliably return complete, accurate award records — a prepared statement policy ensures that every query serving the display layer is structurally safe and consistently predictable
FAQ: Athletic Awards Database Prepared Statement Policy
What is a prepared statement in the context of an athletic awards database?
A prepared statement is a database query defined with a fixed structure and explicit placeholders for input values, compiled before any user-supplied data is inserted. When the query runs, user input is passed as a typed data value separate from the query text—so the database always treats it as data, never as executable SQL. In athletic recognition databases, prepared statements protect search, filter, and export queries from SQL injection by ensuring that sport names, athlete names, season years, and other user-supplied values cannot alter the query’s logic.
What is the difference between a prepared statement and escaping user input in an award database query?
Escaping applies character-level transformations to user input before concatenating it into a SQL string—replacing single quotes with escaped equivalents, for example. Prepared statements separate query structure from data values entirely, so user input never appears in the query text at all. Parameterization is preferred because escaping is error-prone: a missed escape call, an incorrect escaping library for the database dialect, or a multi-byte character encoding edge case can bypass escaping. Prepared statements eliminate these failure modes structurally.
Can column and table names be parameterized in athletic award search queries?
No. SQL database engines treat column and table names as structural elements, not data values, so they cannot be passed as prepared statement parameters. Award search interfaces that allow user-controlled sort columns or export column selection must validate all structural elements against a hardcoded allowlist before including them in the query. Any user choice that does not match an allowlist entry must be rejected before query assembly.
Do recognition platforms handle prepared statement compliance automatically, or does each school need its own policy?
Schools using a managed recognition platform should request confirmation from the vendor that the platform uses parameterized queries throughout the application tier. A written policy is still valuable for governing custom queries, integrations, or exports the school builds on top of the platform. Schools maintaining their own recognition database application must implement parameterization compliance directly in their codebase and document it in a formal policy.
How does prepared statement policy relate to FERPA compliance for student athlete records?
FERPA requires schools to protect the confidentiality of student education records, including athletic participation and award records for enrolled students. SQL injection through unprepared queries can expose, modify, or delete records the attacker was never authorized to access—constituting a reportable FERPA breach. A prepared statement policy is a technical safeguard that directly supports FERPA compliance by preventing query-layer attacks that could lead to unauthorized disclosure of student athlete records.
Building Query Security Into Your Athletic Recognition Infrastructure
An athletic awards database prepared statement policy is, at its core, a commitment to separating query structure from user data at every interface in the recognition system. The commitment has two immediate consequences: it closes the class of SQL injection attacks that allow untrusted input to alter query logic, and it enables the query plan caching that makes repeated parameterized queries faster and more consistent than equivalent dynamic SQL.
Programs that implement this policy before deploying award search and export interfaces—rather than discovering injection vulnerabilities during a security audit or a data breach investigation—spend significantly less time in incident response and significantly more time on the recognition work the database supports. The 50th high school reunion programming and awards ideas guide at digital-trophy-case.com illustrates the long time horizons over which athletic recognition data must remain accurate and accessible—a security foundation built on parameterized queries ensures that data remains trustworthy across decades of updates, new staff, and evolving application interfaces.
Rocket Alumni Solutions’ recognition platform is trusted by 600+ institutions from PGA Tour facilities to small school districts. The platform’s application tier manages award record queries, search interfaces, and export pipelines within a CMS architecture that validates all input before database interaction, propagates updates automatically to every display screen, and maintains complete WCAG 2.1 AA compliance for public-facing recognition content. The platform supports unlimited inductees and award categories, operates on any touchscreen from 32 to 100 inches, and provides remote CMS access so recognition coordinators can manage award data from any location.
Recognition walls that combine physical and digital displays depend on a secure, reliable database layer — a prepared statement policy is the governance document that keeps that layer safe as the recognition program grows
