# Parameterized queries

**URL:** <https://community.neo4j.com/t/parameterized-queries/66681>\
**Category:** Neo4j Graph Platform\
**Created:** [March 6, 2024, 4:39pm UTC](https://community.neo4j.com/t/parameterized-queries/66681 "2024-03-06T16:39:01Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![anshulchaintha7](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/anshulchaintha7/32/27878_2.png) [@anshulchaintha7](https://community.neo4j.com/u/anshulchaintha7)\
**Post date:** [March 6, 2024, 4:39pm UTC](https://community.neo4j.com/t/parameterized-queries/66681/1 "2024-03-06T16:39:01Z")

</div>

does neo4j allows parameterized value for the label?  
query = ( "CREATE (n: $node\_type {ID: $id\_value, Type: $node\_type, Name: $name, Parent: $parent, Child: $child, Role: $role})" )

I am using python language  
Thanks.

---

<div class="post-metadata">

**Author:** ![dana\_canzano](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/dana_canzano/32/27392_2.png) [@dana\_canzano](https://community.neo4j.com/u/dana_canzano)\
**Post date:** [March 6, 2024, 6:44pm UTC](https://community.neo4j.com/t/parameterized-queries/66681/2 "2024-03-06T18:44:09Z")

</div>

@anshulchaintha7

as from the Neo4j v5 documentation, but also applicable for prior versions,

> **[Parameters - Cypher Manual](https://neo4j.com/docs/cypher-manual/current/syntax/parameters/)**
>
> This section describes parameterized querying.

```auto
Parameters cannot be used for the following constructs, as these form part of the query structure that is compiled into a query plan:

property keys; so MATCH (n) WHERE n.$param = 'something' is invalid

relationship types; so MATCH (n)-[:$param]→(m) is invalid

labels; so MATCH (n:$param) is invalid

Parameters may consist of letters and numbers, and any combination of these, but cannot start with a number or a currency symbol.

```

---

<div class="post-metadata">

**Author:** ![anshulchaintha7](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/anshulchaintha7/32/27878_2.png) [@anshulchaintha7](https://community.neo4j.com/u/anshulchaintha7)\
**Post date:** [March 7, 2024, 5:45am UTC](https://community.neo4j.com/t/parameterized-queries/66681/3 "2024-03-07T05:45:18Z")

</div>

Thanks @dana_canzano.  
I checked this query, this is working.  
query = (  
"CREATE (n:`" + node_type + "` {ID: $id\_value, Name: $name, Parent: $parent, Child: $child, Role: $role})"  
)

---

<div class="post-metadata">

**Author:** ![john.stegeman](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/john.stegeman/32/26277_2.png) [@john.stegeman](https://community.neo4j.com/u/john.stegeman)\
**Post date:** [March 7, 2024, 2:29pm UTC](https://community.neo4j.com/t/parameterized-queries/66681/4 "2024-03-07T14:29:43Z")

</div>

... just remember that string concatenation like this is how injection attacks start. Make sure you validate node\_type if it is something a user can provide

---

<div class="post-metadata">

**Author:** ![anshulchaintha7](https://sea1.discourse-cdn.com/flex021/user_avatar/community.neo4j.com/anshulchaintha7/32/27878_2.png) [@anshulchaintha7](https://community.neo4j.com/u/anshulchaintha7)\
**Post date:** [March 7, 2024, 2:49pm UTC](https://community.neo4j.com/t/parameterized-queries/66681/5 "2024-03-07T14:49:00Z")

</div>

Thank you @john.stegeman