向查询传递参数

例如，在查询条件中，或者在 HAVING 语句中使用值，可以通过“内联”方式来实现，即直接将值嵌入到查询字符串中

						POST /_sql?format=txt
					{
  "query": "SELECT YEAR(release_date) AS year FROM library WHERE page_count > 300 AND author = 'Frank Herbert' GROUP BY year HAVING COUNT(*) > 0"
}
		
	

或者通过将值提取到一个单独的参数列表中，并在查询字符串中使用问号占位符（?）来实现

						POST /_sql?format=txt
					{
  "query": "SELECT YEAR(release_date) AS year FROM library WHERE page_count > ? AND author = ? GROUP BY year HAVING COUNT(*) > ?",
  "params": [300, "Frank Herbert", 0]
}
		
	

重要提示

向查询传递值的推荐方法是使用问号占位符，以防止任何黑客攻击或 SQL 注入尝试。