Provide a mechanism for parameterized SQL queries

[KevW]

ODBC libraries typically provide the ability to create parameterized queries that pass the query and parameters to the database separately.  This basically eliminates the risk of SQL injection attacks, but is also very convenient from a programming standpoint.  Because JMP has ODBC queries, it should also have parameterized queries so that you can do:

Execute SQL(database, 
    "Select * from Employees where Name like ? and Status=?",
    "BobList", 
    {"Bob", "Active"}
);

pyodbc's parameterized queries:

https://github.com/mkleehammer/pyodbc/wiki/Getting-started#parameters

The .NET ecosystem's parameterized queries:

https://docs.microsoft.com/en-us/dotnet/api/system.data.odbc.odbccommand.parameters?redirectedfrom=M...

[KevinKirspel]

I think you could implement this using named queries: Create Named Query() and Execute Named Query().  Under the hood, these functions would use the ODBC SQLPrepare(), SQLBindParameter(), and SQLExecute() functions.  The Create Named Query() function would take the SQL statement and parameters.  It would return a named query object.  The Execute Named Query() would take the database connection object, the named query object, and the parameter values as inputs and return the SQL results as a data table (if needed).  The database connection object could be an input of the create function instead of the execute function.  The benefit of this approach is that the creation can happen at script initialization leaving the executing piece separate which will probably be more efficient.