SQL Parameterizer

Overview

You send one SQL statement with values written inline, and we hand back the same statement with bind markers plus a typed list of the slots we created. We work on the WHERE clause of a SELECT, UPDATE or DELETE, and optionally on the LIMIT value; values anywhere else stay exactly where you wrote them. The values themselves never come back — only their position, kind and marker. Reach for something else if you want to run the statement or to swap table and column names, which stay untouched by design.

Regex literal stripping corrupts SQL and leaks values into logs. We rewrite through the parser so shape stays intact and secrets stay out.

When to use it

Scope

Non-goals

• Does not execute SQL
• Does not echo literal values in the response
• Does not rewrite identifiers (table or column names)
• Does not use regex-based literal stripping

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"database.sql_parameterize","input":{"sql":"SELECT 1","dialect":"postgresql"}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("database.sql_parameterize", {"sql":"SELECT * FROM users WHERE email = '[email protected]'","dialect":"postgresql"});

Errors

Other limits

Limitations

• Does not execute SQL
• Does not echo literal values in the response
• Does not rewrite identifiers (table or column names)
• Does not use regex-based literal stripping
• Parameterizing dynamic table or column names
• Running or explaining the query

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "database.sql_parameterize",
  "input": {
    "sql": "SELECT * FROM users WHERE email = '[email protected]'",
    "dialect": "postgresql"
  }
}

Examples

{
  "sql": "SELECT * FROM users WHERE email = '[email protected]'",
  "dialect": "postgresql"
}

{
  "findings": [],
  "_meta": {
    "parserProfile": "jsqlparser-5.3"
  },
  "parameters": [
    {
      "type": "STRING",
      "valueRedacted": true,
      "index": 1,
      "placeholder": "?"
    }
  ],
  "parameterCount": 1,
  "parameterized": "SELECT * FROM users WHERE email = ?",
  "unrewritten": [],
  "complete": true
}

{
  "placeholderStyle": "numbered",
  "sql": "SELECT * FROM orders WHERE id = 42 AND status = 'open'",
  "dialect": "postgresql"
}

{
  "findings": [],
  "_meta": {
    "parserProfile": "jsqlparser-5.3"
  },
  "parameters": [
    {
      "type": "INTEGER",
      "valueRedacted": true,
      "index": 1,
      "placeholder": "$1"
    },
    {
      "type": "STRING",
      "valueRedacted": true,
      "index": 2,
      "placeholder": "$2"
    }
  ],
  "parameterCount": 2,
  "parameterized": "SELECT * FROM orders WHERE id = ? AND status = ?",
  "unrewritten": [],
  "complete": true
}

Recommended use cases

• Prepare agent-generated SQL for safe binding before execution
• Keep sensitive literals out of logs while preserving query shape

Avoid for

• Parameterizing dynamic table or column names
• Running or explaining the query

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags