title: How to set an SQL parameters in Apps Scripts and BigQuery
body: <p>I am trying to avoid a sql injection. This topic has been dealt with in Java (<a href="https://stackoverflow.com/questions/20805617/how-to-prevent-query-injection-on-google-big-query">How to prevent query injection on Google Big Query</a>) and Php.</p>
  
  <p>How is this accomplished in App Scripts? I did not find how to add a parameter to a SQL statement. Here is what I had hoped to do: </p>
  
  <pre><code>  var sql = 'SELECT [row],etext,ftext FROM [hcd.hdctext] WHERE (REGEXP_MATCH(etext, esearch = ?) AND REGEXP_MATCH(ftext, fsearch = ?));';
  
  
    var queryResults;
    var resource = {
        query: sql,
        timeoutMs: 1000,
        esearch='r"[^a-zA-z]comfortable"',
        fsearch='r"[a-z,A-z]confortable"'
    };
  
    queryResults = BigQuery.Jobs.query(resource,projectNumber);
  </code></pre>
  
  <p>And then have esearch and fsearch filled in with the values (which could be set elsewhere). </p>
  
  <p>That does not work, according to the doc.</p>
  
  <p>Any suggestions on how to get a parameter in an SQL query? (I could not find a setString function...)</p>
  
  <p>Thanks!</p>