# SQL parameterization support

**URL:** <https://community.dremio.com/t/sql-parameterization-support/1733>\
**Category:** Uncategorized\
**Created:** [August 30, 2018, 4:47am UTC](https://community.dremio.com/t/sql-parameterization-support/1733 "2018-08-30T04:47:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![swarren](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/swarren/32/586_2.png) [@swarren](https://community.dremio.com/u/swarren)\
**Post date:** [August 30, 2018, 4:47am UTC](https://community.dremio.com/t/sql-parameterization-support/1733/1 "2018-08-30T04:47:49Z")

</div>

The rest SQL execution api doesn’t appear to support parameterization of the SQL. This may be security vulnerability as it allows for SQL injection attacks. Are there any plans to support parameterization of SQL?

---

<div class="post-metadata">

**Author:** ![can](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/can/32/40_2.png) [@can](https://community.dremio.com/u/can)\
**Post date:** [August 30, 2018, 6:59pm UTC](https://community.dremio.com/t/sql-parameterization-support/1733/2 "2018-08-30T18:59:08Z")

</div>

Hey @swarren, this is on our radar, thanks for the +1. We’ll reach out once we have more info around timing.

---

<div class="post-metadata">

**Author:** ![preetigupta](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@preetigupta](https://community.dremio.com/u/preetigupta)\
**Post date:** [August 6, 2020, 4:45pm UTC](https://community.dremio.com/t/sql-parameterization-support/1733/3 "2020-08-06T16:45:56Z")

</div>

> [@can](#):
>
> timing.

Hi,  
Does Dremio support parameterized SQL query, to avoid basic SQL injection vulnerability?

Best regards,  
Preeti

---

<div class="post-metadata">

**Author:** ![jeeshandas](https://avatars.discourse-cdn.com/v4/letter/j/8e8cbc/32.png) [@jeeshandas](https://community.dremio.com/u/jeeshandas)\
**Post date:** [September 8, 2023, 5:31am UTC](https://community.dremio.com/t/sql-parameterization-support/1733/4 "2023-09-08T05:31:56Z")

</div>

Does the SQL API still not support sending parameterized SQL queries? The last post on this topic is over 3 years old.

I want to send an API request from an application with the following SQL query -  
select \* from table1 where column1 == parameter from the application

---

<div class="post-metadata">

**Author:** ![balaji.ramaswamy](https://sea2.discourse-cdn.com/flex020/user_avatar/community.dremio.com/balaji.ramaswamy/32/843_2.png) [@balaji.ramaswamy](https://community.dremio.com/u/balaji.ramaswamy)\
**Post date:** [September 11, 2023, 10:30pm UTC](https://community.dremio.com/t/sql-parameterization-support/1733/5 "2023-09-11T22:30:19Z")

</div>

@jeeshandas This feature is still in the 6th month roadmap but there is no exact ETA