Build a parameterized SQL WHERE clause from filters
Turn search filters into a safe WHERE clause: status active, age of at least 21 and role admin or editor become quoted column names with numbered placeholders, while the values active, 21, admin and editor travel in a separate ordered list. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
Turn a structured list of application filters into the two pieces a database client needs: a SQL WHERE clause with positional placeholders and a separate ordered parameter array. Every field name is quoted as an SQL identifier, including each segment of a qualified name, while values remain outside the SQL text.
Build SQL structure without concatenating values
Dynamic search screens often begin with harmless-looking records such as a field, an operator, and a value. The dangerous step is turning those records into SQL by inserting the value directly into a string. This builder keeps structure and data separate.
Pass the clause into the larger SELECT, UPDATE, or DELETE statement and give the params array to a compatible database driver. Your application should still maintain an allowlist when users can influence field names. Identifier quoting prevents punctuation and reserved words from breaking the generated syntax, but authorization remains an application concern.
Because filters are joined by AND in the supplied order, the output is stable and easy to snapshot, log, compare, or combine with an existing fixed query prefix.
Understand operators, placeholders, and null checks
The supported comparison operators are equality, inequality, ordering comparisons, LIKE, NOT LIKE, IN, NOT IN, IS NULL, and IS NOT NULL. Operator text is normalized to uppercase and repeated whitespace is collapsed, so a human-friendly spelling such as “not like” produces canonical SQL. Every ordinary comparison consumes one parameter.
IN and NOT IN require a non-empty value array and expand it into one placeholder per element, preserving array order. Null-check operators consume no parameter and do not require a value because their SQL grammar contains no placeholder. A missing value for any other operator is rejected instead of silently generating incomplete SQL.
The result deliberately uses numbered dollar placeholders, which suit PostgreSQL and libraries that accept that convention. If your driver uses question marks or named parameters, translate the placeholder syntax in a controlled adapter while preserving the returned parameter order.
Quote identifiers and validate application policy
Each field is treated as a possibly qualified identifier. Empty names and empty dotted segments are rejected. This treatment stops a field string from being confused with unquoted SQL syntax, but it intentionally does not claim that every database engine has identical quoting behavior.
Confirm compatibility with your target database, especially if it does not follow double-quoted identifier conventions. More importantly, escaping is not the same as permission. If an external caller selects fields, map public filter keys to an explicit set of real columns before invoking the builder.
Unsupported SQL operators always produce an input error, which gives callers a clear failure instead of passing unfamiliar syntax through. The capability is deterministic, performs no network requests, and returns only the clause and parameters.
What you can do with it
Build an internal report query
Turn report-builder rows into predictable AND predicates without inserting report values into SQL text.
Generate testable repository queries
Snapshot the deterministic clause and parameter array separately when testing a data-access layer.
FAQ
Does this execute the SQL?
No. It only returns a WHERE clause and an ordered params array; your application supplies both to its database driver.
Can I use IN and NOT IN?
Yes. Supply a non-empty array as the value, and the builder creates one placeholder for every array element.
How are null checks represented?
Use IS NULL or IS NOT NULL. These operators do not need a value and do not add an item to params.
Does identifier escaping replace a column allowlist?
No. Quote escaping protects syntax, while an application allowlist decides which columns and qualified names a caller is authorized to filter.
How are empty-value checks such as IS NULL handled?
IS NULL and IS NOT NULL need no value and use no placeholder, because their SQL wording has nothing to fill in. Every other comparison takes exactly one value, and a missing value is refused instead of producing incomplete SQL.
My database uses question marks; can I still use the result?
Yes, with a small translation. The clause uses numbered dollar placeholders, which suit PostgreSQL. If your library expects question marks or named markers, convert them in one controlled place and keep the returned order of values unchanged.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/dev2/sql-where-builder \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"filters":[{"field":"users.status","operator":"=","value":"active"},{"field":"users.age","operator":">=","value":21}]}'const res = await fetch("https://api.kit.forhosting.com/dev2/sql-where-builder", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"filters": [
{
"field": "users.status",
"operator": "=",
"value": "active"
},
{
"field": "users.age",
"operator": ">=",
"value": 21
}
]
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/dev2/sql-where-builder",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"filters": [
{
"field": "users.status",
"operator": "=",
"value": "active"
},
{
"field": "users.age",
"operator": ">=",
"value": 21
}
]
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/dev2/sql-where-builder", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"filters":[{"field":"users.status","operator":"=","value":"active"},{"field":"users.age","operator":">=","value":21}]}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"filters":[{"field":"users.status","operator":"=","value":"active"},{"field":"users.age","operator":">=","value":21}]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/dev2/sql-where-builder", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"filters": [
{
"field": "users.status",
"operator": "=",
"value": "active"
},
{
"field": "users.age",
"operator": ">=",
"value": 21
}
]
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "dev2.sql_where_builder",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_items | 100 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
Filters are kept in their original order and joined with AND, making the result predictable for query builders, admin tools, report screens, and server endpoints that already collect filters as data.
Build SQL structure without concatenating values
It returns a parameterized SQL WHERE clause containing PostgreSQL-style positional placeholders such as $1 and $2, plus a params array in exactly the matching order. The builder does not execute a query, connect to a database, inspect a schema, or decide which columns a caller may use.
Understand operators, placeholders, and null checks
JSON scalar values are accepted, including strings, numbers, booleans, and null; arrays are reserved for the two list operators.
Quote identifiers and validate application policy
A name such as users.created_at becomes two separately quoted segments, while an embedded double quote is escaped by doubling it according to standard SQL identifier rules. Do the same for business-level operator rules: a reporting endpoint may permit equality and ranges while refusing pattern searches even though the builder supports LIKE.
Integration use cases
Power an API filter endpoint
Convert validated query-string filters into a clause and ordered parameters for a database request.
Technical questions
What does it cost?
Each API request starts at $0.002. The browser runner is available for interactive use.
Which placeholder syntax is generated?
It generates PostgreSQL-style numbered placeholders: $1, $2, and so on.