LLM-to-SQL App Only Sends “?” to BigQuery Instead of Generated Query

[Ignacio_Martinez3]

Hi everyone,

I’m building an app in Retool where users can ask a natural-language question, and Retool’s LLM generates an SQL query based on our database schema. The flow looks like this:

1. We created a Resource that stores our manifest.json (the DB schema Retool’s LLM uses for context).

2. We prompt Retool’s LLM with:

   • The user’s question

   • The parsed manifest schema

3. Retool’s LLM returns an SQL query (wrapped in Markdown).

4. We strip away the Markdown fencing and pass the cleaned SQL string into a BigQuery query component.

5. BigQuery should run the SQL and show a results table.

The issue:

Instead of sending the SQL query generated by the LLM, Retool is only sending a single question mark (?) to BigQuery. Nothing else. So the query fails immediately.

As you can see in the screenshots, the value is populated for cleanSql.data, but when I set the cursor outside the curly braces the SQL prepared statement is indeed “?”.

What we’ve checked already:

• The LLM output looks correct in logs/preview.

• The cleanup step is working (we confirmed we’re passing a valid SQL string into the query component).

• The query component is definitely set to run the correct JS variable/return from JS code.

• Hard-coding the SQL does work, so the issue seems specifically when passing dynamic SQL from the JS code/variable.

• Disable converting queries to prepared statements is unchecked in the BigQuery resource settings.

Thanks!

[Ewan_Larkin-Smith]

Hi @Ignacio_Martinez3, This is likely due to security measures in place that prevent SQL injection from dynamic inputs. I think if you rebuild this using a Retool Agent, which will generate custom SQL, this will not be an issue.

[Ewan_Larkin-Smith]

Hi @Ignacio_Martinez3, It may be worth exploring this thread and check if your resource has the correct setup How to utilise {{data}} in a SQL Query? - #2 by victoria