How to set variable in mutation during upsert?

I’m using the JavaScript client, which has this example upsert with hard-coded email addresses in the query and mutation:

const query = `
  query {
      user as var(func: eq(email, "wrong_email@dgraph.io"))
  }`

const mu = new dgraph.Mutation();
mu.setSetNquads(`uid(user) <email> "correct_email@dgraph.io" .`);

const req = new dgraph.Request();
req.setQuery(query);
req.setMutationsList([mu]);
req.setCommitNow(true);

// Upsert: If wrong_email found, update the existing data
// or else perform a new mutation.
await dgraphClient.newTxn().doRequest(req);

If I want to use a variable in the query, I believe I can do this instead:

const query = `
  query {
      user as var(func: eq(email, $wrongEmail))
  }`
...
const vars = req.getVarsMap();
vars.set("$wrongEmail", "wrong_email@dgraph.io");
...

But how do I set a variable for the new email address in the mutation? I tried this, but it doesn’t work:

mu.setSetNquads(`uid(user) <email> $correctEmail .`);
vars.set("$correctEmail", "correct_email@dgraph.io");
const query = `
  query nameThisQuery ($wrongEmail: string) {
      user as var(func: eq(email, $wrongEmail))
  }`

Should be the correct format. I am not 100% sure on the type: string. Docs: GraphQL variables (confusing title for a section in DQL as it Dgraph now supports GraphQL as well, you might have overlooked this)

Thanks @amaster507. Indeed my post had a mistake in the query syntax. But the question I intended to ask is: How do I set a variable for the new email address in the mutation?

This was just a guess on my part…

mu.setSetNquads(`uid(user) <email> $correctEmail .`);
vars.set("$correctEmail", "correct_email@dgraph.io");

…but it gives me this error:

Error: 2 UNKNOWN: while lexing uid(user) <email> $correctEmail . at line 1 column 30: Invalid input: $ at lexText

Hi @tron, Unfortunately, upsert queries do not have capability to use variables yet. You will have to pass “correct_email” as part of the query.

It is javascript right? Couldn’t you just use a template string?

mu.setSetNquads(`uid(user) <email> "${correctEmail}" .`);
vars.set("$correctEmail", "correct_email@dgraph.io");

@amaster507 Yes, but wouldn’t that make the mutation vulnerable to an injection attack?