fix: Implement raw query parameters field for Microsoft SQL node

[dlavrenuek]

Summary

Add Query Parameters field to Microsoft SQL Node Execute Query operation. This allows passing user controlled input parameters to the query through a prepared statement rather than expressions/string replacement.

Related Linear tickets, Github issues, and Community forum posts

https://linear.app/n8n/issue/NODE-4445

Review / Merge checklist

• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with release/backport (if the PR is an urgent fix that needs to be backported)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cubic-dev-ai]

cubic analysis

1 issue found across 4 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/nodes-base/nodes/Microsoft/Sql/MicrosoftSql.node.ts">

<violation number="1" location="packages/nodes-base/nodes/Microsoft/Sql/MicrosoftSql.node.ts:320">
P1: Numeric query-parameter expressions are mishandled: non-zero numbers are rejected and `0` is silently dropped, which can leave `$n` placeholders unresolved at runtime.</violation>
</file>

Linked issue analysis

Linked issue: NODE-4445: Add Query Parameters field in Microsoft SQL Node "Execute Query" operation

Status	Acceptance criteria	Notes
✅	Add a "Query Parameters" field to the Microsoft SQL node Execute Query operation (UI)	Added options.queryReplacement field in node descriptor
✅	Provide a hint to not use user-controlled inputs in the query itself	Added hint text to query and Query Parameters field
✅	Process $1, $2, ... placeholders and replace them with parameter tokens and bind values to prepared statement (request.input)	Implements reverse-order replacement and request.input binding
✅	Avoid replacing $1 inside $10 (correct placeholder disambiguation)	Uses reverse iteration and regex with (?!\d) to avoid $10 confusion
✅	Accept query parameters as comma-separated string or array; validate type and error on invalid types	Parses comma string to array and throws NodeOperationError for invalid types
✅	Pass parameter values from node options into executeSqlQueryAndPrepareResults and use them when executing the query	Added queryValues param and pass it from node execute flow
✅	Include tests verifying parameter replacement, binding, string/array inputs, invalid type handling, $1 vs $10, and no-parameter case	Added multiple unit tests covering all listed scenarios
✅	Preserve existing expression evaluation behavior for the query	evaluateExpression usage remains and tests still mock it

Architecture diagram

sequenceDiagram
    participant WF as Workflow Engine
    participant Node as Microsoft SQL Node
    participant GF as GenericFunctions.ts
    participant Lib as mssql Library
    participant DB as SQL Server

    Note over WF,DB: Operation: executeQuery

    WF->>Node: execute()
    Node->>Node: Get raw SQL query (e.g., "SELECT * FROM t WHERE id = $1")
    
    rect rgb(30, 41, 59)
    Note right of Node: NEW: Process Query Parameters
    Node->>Node: CHANGED: Get 'queryReplacement' from options
    alt Input is comma-separated string
        Node->>Node: Split string into array
    else Input is already array
        Node->>Node: Use as is
    else Invalid type
        Node-->>WF: Throw NodeOperationError
    end
    end

    Node->>GF: executeSqlQueryAndPrepareResults(pool, rawQuery, index, queryValues)

    rect rgb(23, 37, 84)
    Note right of GF: NEW: Parameter Binding Logic
    GF->>Lib: pool.request()
    Lib-->>GF: request object

    loop For each parameter in queryValues (Reverse Order)
        GF->>GF: NEW: Replace $N with @pN in query string
        GF->>Lib: NEW: request.input('pN', value)
    end
    end

    GF->>Lib: CHANGED: request.query(processedQuery)
    Lib->>DB: Execute Prepared Statement (e.g., "@p1 = 5")
    DB-->>Lib: Rowsets / RowsAffected
    Lib-->>GF: IResult<any>
    
    GF->>GF: Flatten recordsets
    GF-->>Node: Array of INodeExecutionData
    Node-->>WF: Output Data

Loading

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/nodes-base/nodes/Microsoft/Sql/MicrosoftSql.node.ts">

<violation number="1" location="packages/nodes-base/nodes/Microsoft/Sql/MicrosoftSql.node.ts:319">
P2: Array query parameters are filtered with silent value dropping, which can cause placeholder/value mismatches and incorrect query execution. Reject invalid entries instead of removing them.

According to linked Linear issue NODE-4445, query parameters should be reliably passed for prepared statements.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[ShireenMissi]

I tested locally and it works as expected 👏
left a few comments

[ShireenMissi]

LGTM 🎉

[n8n-assistant]

Got released with n8n@2.15.0