---
title: Use parameterized Flux queries
description: Use parameterized queries to re-use Flux queries and dynamically populate variables and prevent injection attacks.
url: https://docs.influxdata.com/influxdb/cloud/query-data/parameterized-queries/
estimated_tokens: 2611
product: InfluxDB Cloud (TSM)
version: cloud
---

# Use parameterized Flux queries

InfluxDB Cloud supports **parameterized Flux queries** that let you dynamically change values in a query using the InfluxDB API. Parameterized queries make Flux queries more reusable and can also be used to help prevent injection attacks.

#### Prevent injection attacks

Use parameterized queries when executing Flux queries with untrusted user input; for example, in a web or IoT application. For more information on security and query parameterization, see the [OWASP SQL Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#defense-option-1-prepared-statements-with-parameterized-queries). While this guide is about SQL, it contains useful general advice.

The InfluxDB Cloud [`/api/v2/query` API endpoint](/influxdb/cloud/api/query-data/) accepts a `params` field in the request body. The `params` field is a JSON object with key-value pairs where the key is a parameter name and the value is the parameter value. For example:

```json
{
  "params": {
    "ex1": "foo",
    "ex2": "bar"
  }
}
```

InfluxDB Cloud inserts the `params` JSON object into the Flux query as a [Flux record](/flux/v0/data-types/composite/record/) named `params`. Use [dot or bracket notation](/flux/v0/data-types/composite/record/#reference-values-in-a-record) to access parameters in the `params` record in your Flux query. For example, using the example `params` JSON above, the following query

```js
from(bucket: params.ex1)
    |> range(start: -1h)
    |> filter(fn: (r) => r._measurement == params.ex2)
```

would execute as

```js
from(bucket: "foo")
    |> range(start: -1h)
    |> filter(fn: (r) => r._measurement == "bar")
```

## Example

To use a parameterized query, do the following:

1. Create your Flux query. Use [dot or bracket notation](/flux/v0/data-types/composite/record/#reference-values-in-a-record) to reference parameters inside the `params` record to populate values at query time. The following example uses `params.mybucket` to define the bucket name.
    
    ```js
    from(bucket: params.mybucket)
        |> range(start: -7d)
        |> limit(n:2)
    ```
    
2. Use the InfluxDB Cloud `/api/v2/query` API endpoint to execute your query. Provide the following in your request body:
    
    -   **query:** Raw Flux query to execute
    -   **params:** JSON object with key-value pairs for each parameter to include in the query.
    
    For example:
    
    ```sh
    curl --request POST \
      'https://cloud2.influxdata.com/api/v2/query?orgID=<YourOrgID>' \
      --header 'authorization: Token <YourAuthToken>' \
      --header 'content-type: application/json' \
      --data '{
        "query":"from(bucket: params.mybucket) |> range(start: -7d) |> limit(n:2)",
        "params":{
          "mybucket":"telegraf"
          }
        }'
    ```
    

## Supported parameter data types

Parameterized Flux queries support `int`, `float`, and `string` data types. To convert the supported data types into other [Flux basic data types](/flux/v0/data-types/basic/), use [Flux type conversion functions](/flux/v0/function-types/#type-conversions).

For example, to define the `start` parameter of the `range()` function using a parameterized duration value:

1. Use the `duration()` function to convert the `param` value into a duration:
    
    ```js
    from(bucket:"example-bucket")
        |> range(start: duration(v: params.mystart))
        |> limit(n:2)
    ```
    
2. In the `param` field of your query request body, format the duration parameter as a string:
    
    ```json
    {
      "query": "from(bucket:\"example-bucket\") |> range(start: duration(v : params.mystart)) |> limit(n:2)",
      "params": {
        "mystart": "-7d"
      }
    }
    ```
    

[query](/influxdb/cloud/tags/query/) [security](/influxdb/cloud/tags/security/)