Run parameterized ClickHouse queries with {name:Type} placeholders via clickhouse-client --param_ or the HTTP interface's param_ query/form parameters to avoid SQL injection from untrusted input.

Documented steps

1. In the query text, mark substitution points using the syntax {name:DataType}, e.g. SELECT * FROM table WHERE int_column = {id:UInt8} and string_column = {phrase:String}.
2. From clickhouse-client, pass each value as a separate --param_<name>=<value> command-line option so the client never string-formats user input into the SQL text: clickhouse-client --param_parName="[1, 2]" --query "SELECT {parName: Array(UInt16)}"
3. Inside an interactive clickhouse-client session, parameters can also be set with SET: SET param_parName='[1, 2]'; then SELECT {parName:Array(UInt16)};
4. Use the Identifier data type when a parameter must supply a table, database, or column name rather than a literal value, e.g. --param_tbl="numbers" --param_col="number" with {tbl:Identifier}, {col:Identifier} in the query.
5. Over the HTTP interface, send the query as the POST body/GET query string and pass parameter values as separate param_<name> query-string or form parameters: curl -sS "<address>?param_id=2&param_phrase=test" -d "SELECT * FROM table WHERE int_column = {id:UInt8} and string_column = {phrase:String}"
6. Multipart form example over HTTP: curl -X POST -F 'query=select {p1:UInt8} + {p2:UInt8}' -F "param_p1=3" -F "param_p2=4" 'http://localhost:8123/'
7. Authenticate HTTP requests alongside the params using HTTP Basic Auth (or user/password query params, not recommended): curl -u "$CLICKHOUSE_USER:$CLICKHOUSE_PASSWORD" 'http://localhost:8123/?param_id=2' -d 'SELECT ... WHERE id={id:UInt8}', or the X-ClickHouse-User / X-ClickHouse-Key headers.
8. Reference: https://clickhouse.com/docs/concepts/features/interfaces/client