# SQL Query as javascript code

**URL:** <https://community.weweb.io/t/sql-query-as-javascript-code/3072>\
**Category:** How do I?\
**Created:** [June 15, 2023, 5:20pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072 "2023-06-15T17:20:55Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 15, 2023, 5:20pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/1 "2023-06-15T17:20:55Z")

</div>

When it comes to workflows, it is possible to send data to a database via an SQL request. There are two ways to do this: using “Formula” or using “JavaScript.” What is the correct approach to send a JavaScript request based on my example (see screenshot below)?

I have taken a very simple example in the screenshot, and I just want to understand the functionality so that I can then convert it into more complex functions.

 ![Screenshot 2023-06-15 184301](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/6/6254300c478c41eb6bb4a7044fc09cb1f924cc69.png)

---

<div class="post-metadata">

**Author:** ![Broberto](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/broberto/32/5918_2.png) [@Broberto](https://community.weweb.io/u/Broberto)\
**Post date:** [June 15, 2023, 8:34pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/2 "2023-06-15T20:34:52Z")

</div>

Is the formula you sent above not working? If yes, what kind of error is it returning? Also, why do you concatenate strings with +? why not write it as a single string?

---

<div class="post-metadata">

**Author:** ![raydeck](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/raydeck/32/384_2.png) [@raydeck](https://community.weweb.io/u/raydeck)\
**Post date:** [June 15, 2023, 8:50pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/3 "2023-06-15T20:50:22Z")

</div>

This is very unusual. What API are you using that supports sending direct SQL? A central subject in cybersecurity is _preventing_ the front end from injecting SQL to the backend.

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 16, 2023, 12:44pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/4 "2023-06-16T12:44:41Z")

</div>

In order to include variables in an SQL request, I have to separate them with “” and + so that the variable is not seen as text.

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 16, 2023, 12:46pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/5 "2023-06-16T12:46:47Z")

</div>

I use a sql request action in the workflow to transfer changes to data to my SQl database. Is there a clearly secure way to send data to a PostgreSQL database via a SQL query?

---

<div class="post-metadata">

**Author:** ![raydeck](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/raydeck/32/384_2.png) [@raydeck](https://community.weweb.io/u/raydeck)\
**Post date:** [June 16, 2023, 1:46pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/6 "2023-06-16T13:46:45Z")

</div>

Usually one would route a request to a back-end using the variables you want to send, andthen that back-end would be responsible for forming a SQL query.

With limited exceptions, weweb actions run on the front end - within the user’s browser. That means a malefactor with access to their computer, credentials, or pulling the token can write _whatever_ SQL they want back to your endpoint, because the weweb code is not locked down. Backend code (supabase, pipedream, Xano, etc) would be a more secure router and standard practice for managing this workflow.

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 19, 2023, 7:49pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/7 "2023-06-19T19:49:34Z")

</div>

As a small update, I have now switched my database to Supabase. It’s a cool tool! I hope the WeWeb Team expands it with additional important features. 😃

---

<div class="post-metadata">

**Author:** ![Broberto](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/broberto/32/5918_2.png) [@Broberto](https://community.weweb.io/u/Broberto)\
**Post date:** [June 19, 2023, 10:18pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/8 "2023-06-19T22:18:54Z")

</div>

What kind of features are you missing in terms of WeWeb and Supabase? 🙂

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 20, 2023, 4:51am UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/9 "2023-06-20T04:51:59Z")

</div>

I think one of the key feature would be the integration of uploading files directly to the storage of Supabase. In my mind it could solved within the plug-in. But I recognized, that this feature ist on the WeWeb “Request a feature” page. I’l be hoping that the WeWeb Team sets a focus on it 😃

---

<div class="post-metadata">

**Author:** ![raydeck](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/raydeck/32/384_2.png) [@raydeck](https://community.weweb.io/u/raydeck)\
**Post date:** [June 20, 2023, 2:09pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/10 "2023-06-20T14:09:32Z")

</div>

You can do that upload using the signed URL functionality of Supabase today. It might not have the same ergonomics that an eventual first-party plugin would have, but its not super complex near as I see.

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 20, 2023, 4:59pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/11 "2023-06-20T16:59:06Z")

</div>

I even managed to get the upload to work via javascript:  
Next question is how to get the link from Supabase as “signed url” for displaying the item in a collection. Do you have an advice?

```auto
var formData = new FormData();
var imagefile = wwLib.getFrontDocument().querySelector('#shot_thumbnail input');
var originalFileName = variables[/* fileUploaderID input - value */ 'XXXX']?.['name'];
var user_id = pluginVariables[/* supabaseAuth user */ 'XXXXX']['user']?.['id']

var timestamp = Date.now();
var uniqueFileName = timestamp + '_' + user_id + '_' + originalFileName;

formData.append("content", imagefile.files[0]);
return await axios.post("https://XXXX.supabase.co/storage/v1/object/images/shotlist_thumbnails/" + uniqueFileName, formData, {
    headers: {
        "Content-Type": "multipart/form-data",
        "Authorization": "Bearer XXXXXX"
    }
});pluginVariables[/* supabaseAuth user */ 'XXXX']['user']?.['id']

```

---

<div class="post-metadata">

**Author:** ![raydeck](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/raydeck/32/384_2.png) [@raydeck](https://community.weweb.io/u/raydeck)\
**Post date:** [June 20, 2023, 5:38pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/12 "2023-06-20T17:38:30Z")

</div>

Is this what you are looking for? [Supabase Javascript Client - Create a signed URL](https://supabase.com/docs/reference/javascript/storage-from-createsignedurl)

---

<div class="post-metadata">

**Author:** ![tillyboard](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/tillyboard/32/3317_2.png) [@tillyboard](https://community.weweb.io/u/tillyboard)\
**Post date:** [June 20, 2023, 8:07pm UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/13 "2023-06-20T20:07:09Z")

</div>

Yes that’s the right thing I’am searching for! 😃

Unfortunately, I don’t understand exactly how to put the following code in the javascript field so that the request is also sent to the correct Supabase endpoint and I also use my credentials correctly. Can you help me here and give an example?

 ![Bildschirm­foto 2023-06-20 um 22.06.32](https://us1.discourse-cdn.com/flex016/uploads/weweb/original/2X/a/a64a55e1b6b3035a514a62fd0aaa529acaca54b3.png)

---

<div class="post-metadata">

**Author:** ![raydeck](https://sea2.discourse-cdn.com/flex016/user_avatar/community.weweb.io/raydeck/32/384_2.png) [@raydeck](https://community.weweb.io/u/raydeck)\
**Post date:** [June 21, 2023, 1:34am UTC](https://community.weweb.io/t/sql-query-as-javascript-code/3072/14 "2023-06-21T01:34:19Z")

</div>

I understand! This is the kind of deeper work we do in [State Change office hours](https://statechange.ai) and our forum.

The proximate error is about using async/await - and that is relatively fixable - but I don’t think that’s your real problem. At a guess, the code you are looking at is meant to be run on the _backend_ e.g. a function or some such rather than in weweb, because it requires the API key in order to generate the signed URL.