Timestream prepared queries

Question

I am really puzzled by Timestream [PrepareQuery](https://docs.aws.amazon.com/timestream/latest/developerguide/API_query_PrepareQuery.html).  You can make this call and it will validate it but not store it.  But then I don't see how you would use that.

I'm using, specifically, the [typescript api](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/clients/client-timestream-query/classes/preparequerycommand.html)

I was interested in this mainly from the perspective of SQL-safe parameter substitution.  It's discouraged to build query strings with just a plain string concat, it gives you exposure to injection attacks.  So having some kind of sql safe parameter substitution is pretty important.

Am I missing something?

Accepted Answer

Amazon Timestream does not support parameterized queries natively, and the PrepareQuery API method is meant for query validation and not for storing or using prepared statements.  You can use the following as a workaround and sanitize your inputs  
```
import { escape } from 'mysql';

let userId = getUserInput();
let query = `SELECT * FROM users WHERE id = ${escape(userId)}`;

```

Timestream prepared queries

相关内容