Feature: Send variables alongside query for HTTP /sql route

Is your feature request related to a problem?

Yes, it's currently not possible to send variables alongside a query for the HTTP /sql route, as the query itself already occupies the request body. This poses a potential security risk as you now have to embed the values into your queries manually.

Describe the solution

When the Content-Type header is set to application/json, accept a body like the following:

{
  "query": "SELECT * FROM type::table($table);",
  "params": {
    "table": "something"
  }
}

When the Content-Type is not set, or to text/plain, still accept a query as the body

Alternative methods

Use sketchy methods to embed values into queries

SurrealDB version

1.0.0-beta.9+20230623.6d5dcfa for macos on aarch64

Contact Details

[email protected]

Is there an existing issue for this?

• I have searched the existing issues

Code of Conduct

• I agree to follow this project's Code of Conduct