# Support DQL variables in mutations

**URL:** <https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819>\
**Category:** Dgraph\
**Tags:** dgraph, kind:enhancement, status:accepted, area:upsert, area:querylang:vars\
**Created:** [January 18, 2020, 11:27pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819 "2020-01-18T23:27:13Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![diggy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/diggy/32/3666_2.png) [@diggy](https://discuss.dgraph.io/u/diggy)\
**Post date:** [January 18, 2020, 11:27pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/1 "2020-01-18T23:27:13Z")

</div>

**Moved from GitHub [dgraph/4615](https://github.com/dgraph-io/dgraph/issues/4615)**

_Posted by_ [F21](https://github.com/F21):

## Experience Report

### What you wanted to do

I want to perform a mutation in an upsert block using user-provided data safely.

### What you actually did

```auto
upsert ($name: string){
      query {
        var(func: eq(xid, "http://schema.org/Person")) {
          Type as uid
        }
        var(func: eq(<http://schema.org/name>, "Robin Wright")) {
          Person as uid
        }
      }
      mutation {
          set {
           uid(Person) <xid> "https://www.themoviedb.org/person/32-robin-wright" .
           uid(Person) <http://schema.org/type> uid(Type) .
           uid(Person) <http://schema.org/name> $name .
           uid(Person) <dgraph.type> "Person" .
          }
      }
    }

```

### Why that wasn’t great, with examples

GraphQL variables are not supported in mutations, so it’s impossible to safely mutate user-provided data without error-prone validation.

### Any external references to support your case

None at the moment.

---

<div class="post-metadata">

**Author:** ![diggy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/diggy/32/3666_2.png) [@diggy](https://discuss.dgraph.io/u/diggy)\
**Post date:** [March 5, 2020, 12:22pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/2 "2020-03-05T12:22:01Z")

</div>

[miko](https://github.com/miko) _commented_ :

I also support this request. The rationale is the same as for GraphQL variables in queries: [https://docs.dgraph.io/query-language/#graphql-variables](https://docs.dgraph.io/query-language/#graphql-variables)

---

<div class="post-metadata">

**Author:** ![diggy](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/diggy/32/3666_2.png) [@diggy](https://discuss.dgraph.io/u/diggy)\
**Post date:** [March 11, 2020, 11:50pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/3 "2020-03-11T23:50:05Z")

</div>

[MichaelJCompton](https://github.com/MichaelJCompton) _commented_ :

This looks like a reasonable feature request.

I’m tagging it as accepted, which means it will get into our backlog of features to consider.

If we decide to implement it, we’ll post an update here.

---

<div class="post-metadata">

**Author:** ![freb](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/freb/32/2642_2.png) [@freb](https://discuss.dgraph.io/u/freb)\
**Post date:** [November 19, 2020, 10:19am UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/4 "2020-11-19T10:19:01Z")

</div>

I just ran into this as well. Do you know if there has been a decision about whether this will be implemented?

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [November 19, 2020, 5:04pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/5 "2020-11-19T17:04:10Z")

</div>

@hardik do you have any idea?

---

<div class="post-metadata">

**Author:** ![freb](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/freb/32/2642_2.png) [@freb](https://discuss.dgraph.io/u/freb)\
**Post date:** [November 20, 2020, 3:37am UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/6 "2020-11-20T03:37:25Z")

</div>

Just to provide some more context. In my specific case I needed to pass a Uid variable. This is pretty easy to validate before concatenating with the query string.

In cases where the variable is some sort of free-form string originating from a client, it would be very difficult to ensure the upsert query isn’t being injected. Essentially all the same reasons GraphQL variables are supported in standard queries.

But like I said, for Uids this isn’t much of an issue beyond having to prepare the requests a little differently.

---

<div class="post-metadata">

**Author:** ![masonlr](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/masonlr/32/7461_2.png) [@masonlr](https://discuss.dgraph.io/u/masonlr)\
**Post date:** [March 31, 2021, 5:51pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/8 "2021-03-31T17:51:23Z")

</div>

+1 for this feature.

Would it be possible to make it more clear in docs that upsert variables aren’t currently supported? (I spent a lot of time trying to debug this today when I came across the problem in pydgraph and then reproduced a minimal example using raw `curl` requests.)

## Minimal Example

Set the schema using GraphQL:

```auto
# schema.graphql
type Project {
    id: String! @id
    name: String @search(by: [term])
    description: String @search(by: [term])
}

```

Create the schema:

```auto
curl -X POST localhost:8080/admin/schema --data-binary '@schema.graphql'

```

Create inital data:

```auto
curl -H "Content-Type: application/json" -X POST localhost:8080/mutate?commitNow=true -d $'
    {
      "set": [
        {
          "Project.id": "06b49118-a34a-4254-b1a1-49e3096676aa",
          "Project.name": "test",
          "Project.description": "test",
          "dgraph.type": "Project"
        },
        {
          "Project.id": "8296209e-9e3e-4170-892f-14ca17281eca",
          "Project.name": "test",
          "Project.description": "test",
          "dgraph.type": "Project"
        }
      ]
    }' | jq

```

Demonstrate the problem:

### First example fails with variable

```auto
curl -H "Content-Type: application/json" -X POST localhost:8080/mutate?commitNow=true -d '
{
  "query": "query foo($id: string) { bar(func: eq(Project.id, $id )) {v as uid} }",
  "delete": {
    "uid": "uid(v)"
  },
  "variables": {"$id": "8296209e-9e3e-4170-892f-14ca17281eca"}
}' | jq

```

The response `bar` query is blank:

```json
{
  "data": {
    "code": "Success",
    "message": "Done",
    "queries": {
      "bar": []
    },
    "uids": {}
  },
  "extensions": {
    "server_latency": {
      "parsing_ns": 44507,
      "processing_ns": 837772,
      "encoding_ns": 29162,
      "assign_timestamp_ns": 757242,
      "total_ns": 1750146
    },
    "txn": {
      "start_ts": 21328,
      "commit_ts": 21329
    }
  }
}

```

### Second example works with a hard-coded data

```auto
curl -H "Content-Type: application/json" -X POST localhost:8080/mutate?commitNow=true -d '
{
  "query": "query foo($id: string) { bar(func: eq(Project.id, \"8296209e-9e3e-4170-892f-14ca17281eca\" )) {v as uid} }",
  "delete": {
    "uid": "uid(v)"
  },
  "variables": {"$id": "8296209e-9e3e-4170-892f-14ca17281eca"}
}' | jq

```

The response `bar` query is populated:

```json
{
  "data": {
    "code": "Success",
    "message": "Done",
    "queries": {
      "bar": [
        {
          "uid": "0x4ec9"
        }
      ]
    },
    "uids": {}
  },
  "extensions": {
    "server_latency": {
      "parsing_ns": 85802,
      "processing_ns": 1154781,
      "encoding_ns": 50707,
      "assign_timestamp_ns": 507082,
      "total_ns": 1828617
    },
    "txn": {
      "start_ts": 21309,
      "commit_ts": 21310,
      "preds": [
        "1-Project.description",
        "1-Project.id",
        "1-Project.name",
        "1-dgraph.type"
      ]
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [March 31, 2021, 7:27pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/9 "2021-03-31T19:27:32Z")

</div>

Hey, this issue is to track DQL Vars on mutations. I think there is one about the RAW HTTP requests. Currently Dgo supports DQL Vars on Upsert Block. The other clients I’m not sure about.

---

<div class="post-metadata">

**Author:** ![masonlr](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/masonlr/32/7461_2.png) [@masonlr](https://discuss.dgraph.io/u/masonlr)\
**Post date:** [March 31, 2021, 7:49pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/10 "2021-03-31T19:49:09Z")

</div>

> [@MichelDiz](#):
>
> this issue is to track DQL Vars on mutations

Apologies, I thought this was relevant as the examples are using DQL queries and the `mutate` endpoint.

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [March 31, 2021, 8:53pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/11 "2021-03-31T20:53:26Z")

</div>

It is the same topic, but different things. We have a kind of support for DQL Vars in Upsert Block mutation, but there’s no concept of DQL vars in the mutation block which is the point of the user F21.

---

<div class="post-metadata">

**Author:** ![Poolshark](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/poolshark/32/10074_2.png) [@Poolshark](https://discuss.dgraph.io/u/Poolshark)\
**Post date:** [October 3, 2022, 1:05pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/12 "2022-10-03T13:05:42Z")

</div>

@MichelDiz

> [@MichelDiz](#):
>
> It is the same topic, but different things. We have a kind of support for DQL Vars in Upsert Block mutation, but there’s no concept of DQL vars in the mutation block which is the point of the user F21.

How do we use vars inside `upsert` then?

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [October 3, 2022, 9:12pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/13 "2022-10-03T21:12:40Z")

</div>

[https://dgraph.io/docs/mutations/upsert-block/](https://dgraph.io/docs/mutations/upsert-block/)

There is also conditional upsert:

[https://dgraph.io/docs/mutations/conditional-upsert/](https://dgraph.io/docs/mutations/conditional-upsert/)

J

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [October 3, 2022, 11:06pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/14 "2022-10-03T23:06:45Z")

</div>

Let’s not confuse things. This post is about DQL Vars(former GraphQL Variables). It’s not about query/Value variables. But you could use vars(Value variables) in conjunction with DQL Vars.

But we need to support this

> [@Custom Block - Discussion](http://discuss.hypermode.com/t/custom-block-discussion/4023):
>
> PS. Some people may think that [GraphQL Vars](https://dgraph.io/docs/query-language/#graphql-variables) would be the same as a custom block at some level. But it is not possible to re-sign a G. Vars. Something that would be necessary to be reused in other blocks. One of the intentions would be to “append” values from other blocks and use them in third blocks. That’s not possible in G. Vars. I would like to open a discussion on introducing a “Custom Block”. Today only aggregation can use Empty Blocks e.g: “Only aggregated variables allowed within em…

e.g.

```auto
curl -H "Content-Type: application/rdf" -X POST localhost:8080/mutate?commitNow=true -d $'
upsert {
  query foo($value: string) {
    v as var(func: eq(something)) {
      test as string($value) #this doesn't exist
    }
  }

  mutation {
    set {
      uid(v) <other> val(test) . #you would pass the value via test variable.
    }
  }
}' | jq

```

---

<div class="post-metadata">

**Author:** ![Poolshark](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/poolshark/32/10074_2.png) [@Poolshark](https://discuss.dgraph.io/u/Poolshark)\
**Post date:** [October 4, 2022, 7:32am UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/15 "2022-10-04T07:32:02Z")

</div>

@MichelDiz thanks for the answer!

Maybe I have to elaborate a bit more here. I think I know how to define the variables in a query but I have no clue how to submit/attach them with the mutation!

I’m using `dql.mutate` in a custom lambda and tried

```auto
dql.mutate({
  query: `query Test($uid: string) { q(func: uid($uid)) { uid }`,
  mutations:[{}],
  variables: { $uid: “0x1” }
})

```

But then I’m getting the error that a UID must be defined, which indicates that `$uid` is not getting submitted.

---

<div class="post-metadata">

**Author:** ![MichelDiz](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/micheldiz/32/11873_2.png) [@MichelDiz](https://discuss.dgraph.io/u/MichelDiz)\
**Post date:** [October 4, 2022, 1:55pm UTC](https://discuss.dgraph.io/t/support-dql-variables-in-mutations/8819/16 "2022-10-04T13:55:57Z")

</div>

I’m afraid Upsert Mutation doesn’t support DQL variables. Because they are from the Query context. And Upsert Query is a mutation with Query characteristics. I remember there was a way to make this happen via go. But via RAW HTTP it was not. It was one thing to check and then support.

lambdas are RAW HTTP. Unless you use gRPC somehow.