R readline prompt to use in SQL script within R - sql

Question

I am running a sql script within R. There is a date filter within the script and right now it is hardcoded in. Using the extract I run some analysis, etc. My final goal is to turn this script into Shiny.
I want to be able to make the date filter a prompt using readlines. Does anyone know if I can stick the date in the SQL script using that readline output?
For example:
Readline asks Start date?
Input as 2020-10-01 and gets set as X
The sql code reads:
SELECT * from database
WHERE DATE= 'X'
Thank you!

Answer 1

Using Parameterised Query
As pointed out in the comments, using paste is unsafe as it leaves the system vulnerable to exploits such as sql injection attacks. This can be mitigated by using parametrised queries, this is a helpful document for reference.
# Get input
r <- readline("Input Date: ")
# Using parameterised Query
sql <- "SELECT * FROM database WHERE DATE = ?"
# Send the paramterised query
query <- DBI::dbSendQuery(conn_string, sql)
# Bind the parameter
DBI::dbBind(query, list(r))
# Fetch Result
DBI::dbFetch(query)
You can also use the sqlInterpolate if having trouble with parameterised query,
query <-
sqlInterpolate(conn_string,
"SELECT * FROM database WHERE DATE = ?date",
date = r
)
# Get Results
dbGetQuery(conn_string, query)
Unsafe way
You can use paste0() to process the date string using single quotes correctly.
# Get input
r <- readline("Input Date: ")
# Paste input with query string noting the use of single quotes '
query <- paste0("SELECT * FROM database WHERE DATE = '", r, "'")
# Make query
dbGetQuery(conn, query)