sql - Parameterizing 'limit' and 'order' in sqlite3 -

i have sqlite query i'm looking parameterization avoid bad sql injection things on internet...

so things like:

select * mytable id = $id 

are fine if have $id defined somewhere , pass parameter db calls.

paramters.$id = 150;  db.all(myquery, parameters, function (err, rows) {   results = rows; }); 

i wonder if need go out of way parameterize things sorted , paginated (both inputs users can give)...

i tried like:

    var sorter = json.parse(value);     parameters.$sortmethod = sorter.method;     parameters.$sortorder = sorter.order;     sort_filter += 'order $sortmethod $sortorder'; 

no dice though. i'm guessing sqlite3 doesn't let parameterize things in order, limit , offset. thought there sneaky maybe folks out there ending sqlite statement prematurely in order , creating new malicious statement, maybe sqlite3 lets exercise 1 statement @ time (http://www.qtcentre.org/threads/54748-execute-multiple-sql-command-in-sqlite3)

should not worry parameterizing things in order limit , offset? reference, i'm running on node.js sqlite library: https://github.com/mapbox/node-sqlite3

thanks in advance!

sqlite (and other database) allows parameterize expressions, is, numbers, strings, blobs, or null values appear in statement. includes values in limit/offset clauses.

anything else cannot parameterized. table , column names, operators, or other keyword (like select, order by, or asc).

if need change parts of sql statements not expressions, have create statement on fly. (there no danger of sql injection long code constructs statement itself, not using unchecked user data.)