Parameterized query with query is wrong somewhere

[al2o3cr]

@hudsonbay

I’m trying to avoid SQL injection attacks by avoiding dynamic values.

That’s a good principle. It’s also why your query doesn’t work - a bound parameter like $1 will always be a value not parsed by SQL - ($1::varchar) with $1 = "user_id,car_id" has one element which is that whole string.

This thread may be helpful:

Ecto IN clauses with tuples

Hello people! I have a requirement to perform a select query with IN clause using tuples. I am using PostgreSQL. Example: select * from my_table where (col1, col2, col3) in ((1, 2, 3), (4, 5, 6), (7, 8, 9)); This is valid SQL that we can’t, currently, express with Ecto. Tried with several interpolation techniques but was not successful. The list of values is dynamic in content and length (can’t use a fragment here). We are falling back to a Repo.query! (making sure this is not a public quer…