# Sqlite dynamic number of parameters

**URL:** <https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506>\
**Category:** General\
**Created:** [23 March 2020 12:06 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506 "2020-03-23T12:06:05Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![tukru](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tukru](https://discourse.nodered.org/u/tukru)\
**Post date:** [23 March 2020 12:06 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/1 "2020-03-23T12:06:05Z")

</div>

Hi all,  
I need to pass a dynamic number of parameters to a query. For example:

SELECT \* FROM test WHERE text\_field = "test" OR number\_field = "500" OR text\_field = "value"

I know I can do it using msg.topic but I want to check sql injection so I want to do it with prepared statment. If I can't do it with prepared statment is there a better way than check it with regular expressions?

The ideal situation would be to solve the select above but at least if I can solve an IN with dynamic parameters would be something.

Example:

SELECT \* FROM test WHERE ID IN(1,50,23,41)

Thanks

---

<div class="post-metadata">

**Author:** ![bakman2](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bakman2/32/6207_2.png) [@bakman2](https://discourse.nodered.org/u/bakman2)\
**Post date:** [23 March 2020 12:14 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/2 "2020-03-23T12:14:23Z")

</div>

> I know I can do it using msg.topic

If you use a function node, you can create `msg.topic` dynamically.

---

<div class="post-metadata">

**Author:** ![tukru](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tukru](https://discourse.nodered.org/u/tukru)\
**Post date:** [23 March 2020 12:15 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/3 "2020-03-23T12:15:40Z")

</div>

I know, but is what I am saying. I would like to do it with prepared statment. In a prepared statment can I pass also the msg.topic?

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [23 March 2020 12:32 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/4 "2020-03-23T12:32:53Z")

</div>

Well the sqlite node certainly supports prepared statements as you will have seen. I did some quick searching and I'm not sure how it works, been a long time since I used that node. The node notes that it uses `db.all`, docs for that are here:

> **[mapbox/node-sqlite3](https://github.com/mapbox/node-sqlite3/wiki/API#databaseallsql-param--callback)**
>
> Asynchronous, non-blocking SQLite3 bindings for Node.js - mapbox/node-sqlite3

---

<div class="post-metadata">

**Author:** ![tukru](https://avatars.discourse-cdn.com/v4/letter/t/f0a364/32.png) [@tukru](https://discourse.nodered.org/u/tukru)\
**Post date:** [23 March 2020 13:11 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/5 "2020-03-23T13:11:58Z")

</div>

Ok, I see it's another way to do it. I was thinking to make all with the node-red-node-sqlite but if there isn't another work around that should work. Thanks.

I will wait because maybe there is another way to do it and using node-red-node-sqlite and prepared statment.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [22 May 2020 13:12 UTC](https://discourse.nodered.org/t/sqlite-dynamic-number-of-parameters/23506/6 "2020-05-22T13:12:03Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.