I'm code reviewing some javascript that constructs SQL and passes it to labkey server via new LABKEY.ext.Store({ sql: "SELECT ..."}) as well as other APIs. Various string values are simply concatenated into a SQL string which is error prone and can possibly be a security problem.

Is there a way to construct a prepared statement in labkey SQL such as passing an object instead of a string. e.g.

var first_name = "Ted"
var age = 30
var s=new LABKEY.ext.Store({ sql:{ sql:"SELECT first_name,last_name FROM person WHERE first_name=? AND AGE<?", arg1:first_name, arg2:age }})

instead of

var first_name = "Ted"
var age = 30
var s = new LABKEY.ext.Store({ sql:"SELECT first_name,last_name FROM person WHERE first_name='" + first_name + "' AND AGE<" + age })

If not, is there an easy way to SQL quote the arguments based on javascript type?

Robert.