{"record":{"id":"23dcc04dbbde1d11","repo":"Budibase/budibase","slug":"parameter-key-input-contains-a-handlebars-bin","errorCode":null,"errorMessage":"Parameter '${key}' input contains a handlebars binding - this is not allowed.","messagePattern":"Parameter '(.+?)' input contains a handlebars binding - this is not allowed\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/api/controllers/query/index.ts","lineNumber":79,"sourceCode":"  timeoutMs: env.QUERY_THREAD_TIMEOUT,\n})\n\nfunction sanitiseUserStructure(user: ContextUser) {\n  const copiedUser = cloneDeep(user)\n  delete copiedUser.roles\n  delete copiedUser.account\n  delete copiedUser.license\n  return copiedUser\n}\n\nfunction validateQueryInputs(parameters: QueryEventParameters) {\n  for (let entry of Object.entries(parameters)) {\n    const [key, value] = entry\n    if (typeof value !== \"string\") {\n      continue\n    }\n    if (findHBSBlocks(value).length !== 0) {\n      throw new Error(\n        `Parameter '${key}' input contains a handlebars binding - this is not allowed.`\n      )\n    }\n  }\n}\n\nexport async function fetchQueries(ctx: UserCtx<void, FetchQueriesResponse>) {\n  ctx.body = await sdk.queries.fetch()\n}\n\nconst _import = async (\n  ctx: UserCtx<ImportRestQueryRequest, ImportRestQueryResponse>\n) => {\n  const body = ctx.request.body\n  const importerInput = body.restTemplateId\n    ? { data: await sdk.restTemplates.getSpec(body.restTemplateId) }\n    : body\n  const importer = await createImporter(importerInput)","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/api/controllers/query/index.ts#L61-L97","documentation":"`validateQueryInputs` rejects query parameter values that contain Handlebars `{{...}}` blocks. Parameters with literal handlebars bindings would be evaluated or leak binding syntax into requests, so any string parameter containing `{{` blocks throws this error. It is invoked via `enrichParameters` when query inputs are saved or executed.","triggerScenarios":"Saving or running a REST/SQL query where any entry in the `parameters` object is a string containing a handlebars block, e.g. `{ name: \"{{user.id}}\" }`. Only string values are checked; other types pass through.","commonSituations":"A user pastes a URL or payload copied from another tool that already contains `{{...}}` templating; UI binding was accidentally typed as literal text instead of bound through the binding picker; migrating queries where dynamic values should be declared in the query string, not in default parameter values.","solutions":["Remove the `{{...}}` text from the parameter value and enter the raw literal value","Configure the dynamic part as a binding in the query definition itself rather than in the default parameter value","If the value legitimately contains double braces, escape or restructure it so `findHBSBlocks` finds no match","Update the saved query/API request body to use proper interpolation syntax supported by the query editor"],"exampleFix":"// before\nparameters: { userId: \"{{ user._id }}\" }\n// after\nparameters: { userId: \"1234\" } // and bind {{ userId }} in the query string","handlingStrategy":"validation","validationCode":"const hasHbs = (v) => typeof v === \"string\" && /\\{\\{[\\s\\S]*?\\}\\}/.test(v)\nconst clean = Object.fromEntries(Object.entries(params).filter(([, v]) => !hasHbs(v)))","typeGuard":null,"tryCatchPattern":"try {\n  await api.saveQuery({ parameters })\n} catch (e) {\n  if (String(e.message).includes(\"handlebars binding\")) {\n    // strip bindings and retry with literal values\n  }\n}","preventionTips":["Never paste templated URLs/payloads directly into parameter defaults","Use the binding drawer in the query editor instead of typing {{ }} manually","Sanitize user-provided parameter values before submitting","Remember: bindings belong in the query string/body, not in parameter values"],"tags":["handlebars","validation","parameters"],"backgroundTag":"invalid-template-binding","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}