Query Parameters

Use :name placeholders in SQL queries, fill values in a panel, execute with prepared statements

Write :id where the value goes, then press Cmd+Enter twice: once to raise the fields, once to run. A :word inside a string, a comment, or a PostgreSQL cast is left alone.

Query parameter panel

SELECT *
FROM orders
WHERE customer_id = :customer_id
  AND status = :status
  AND created_at > :since;

That query raises three rows, in the order the names first appear. Each row is the parameter name, a value field, a type popup (String, Integer, Decimal, Date or Boolean), and a NULL checkbox that binds NULL and disables the field.

Every parameter needs a value or NULL. Running with one empty stops with “Missing value for parameter: :name” instead of going to the server. Clear All empties every value field, and the X button hides the panel until the next run.

Where the driver has a parameter API the value is bound, never pasted into the text; everywhere else it is escaped. Either way you never quote a value yourself, and a ' in a value is not an injection.

What counts as a parameter

:name is detected when name starts with a letter or underscore. These are not:

Pattern	Why
':name'	Inside a string
-- :name	Inside a comment
/* :name */	Inside a block comment
col::integer	PostgreSQL type cast
$$ :name $$	Dollar-quoted string
:123	Starts with a digit

The same name twice (:id = :id) gets one field and one value.

LIKE patterns and IN lists

One placeholder is one value, which is where both of these go wrong.

For a LIKE, put the wildcards in the value rather than the SQL. LIKE '%:term%' is a string literal and no parameter at all; write LIKE :term and type %acme% into the field.

For an IN list, a single :ids binds the whole thing as one value and matches nothing. Write one placeholder per value:

SELECT * FROM orders WHERE status IN (:a, :b, :c);

Values are kept with the tab

Values are saved with the tab and survive tab switches and app restarts. Editing the query keeps the values whose names still match, empties the fields for new names, and drops the ones that are gone.

Values are never recorded in query history, so loading a parameterized entry from there raises the panel rather than running it.

Several statements at once

Execute All Statements (Cmd+Shift+Enter) collects every unique name across the whole script into one panel. Each statement binds only the parameters it uses.

INSERT INTO users (id, name) VALUES (:id, :name);
SELECT * FROM users WHERE id = :id;

Both use :id. Only the INSERT uses :name.

Where it applies

Parameters are read when a query tab runs: Cmd+Enter, Execute All Statements, and the run buttons in the gutter. A parameterized query still goes through safe mode, so DROP, TRUNCATE, and DELETE without WHERE still ask first.

Settings

Settings > Editor > Query parameters (:name syntax), on by default. Turn it off and :name is sent to the database exactly as written.