--- title: Writing SQL in SQL Connect | daily.dev description: Firebase Data Connect (now called SQL Connect) launches Native SQL, a feature allowing developers to write raw SQL directly inside .gql operation files while... canonical: https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Writing SQL in SQL Connect | daily.dev og:description: Firebase Data Connect (now called SQL Connect) launches Native SQL, a feature allowing developers to write raw SQL directly inside .gql operation files while... og:url: https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4 og:image: https://api.daily.dev/og/posts/ycdviSkE4.png og:image:alt: Writing SQL in SQL Connect og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Writing SQL in SQL Connect **[Firebase](https://daily.dev/sources/firebase-blog)** · 11 min read · 0 upvotes · 0 comments ## Summary Firebase Data Connect (now called SQL Connect) launches Native SQL, a feature allowing developers to write raw SQL directly inside .gql operation files while still benefiting from Data Connect's Firebase integrations and auto-generated SDKs. New root fields like _select, _selectFirst, _execute, _executeReturning, and _executeReturningFirst let developers run advanced PostgreSQL operations—window functions, CTEs, geospatial queries via PostGIS—that don't map cleanly to GraphQL types. SQL statements are hardcoded at deploy time and parameterized, preventing SQL injection, and context injection via {_expr: "auth.uid"} enforces server-side authorization. The post also covers the existing @view directive for read-only, strictly-typed SQL-backed types, and gives guidance on when to use native GraphQL, @view, @transaction, or Native SQL for queries and mutations, plus best practices around client-side JSON validation and query performance tuning. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I run raw SQL queries in Firebase Data Connect instead of GraphQL operations? Native SQL for Data Connect lets you define operations using raw SQL syntax directly in your .gql operation files via new root fields on the query and mutation types. Use _select or _selectFirst for read queries and _execute, _executeReturning, or _executeReturningFirst for DML like INSERT, UPDATE, and DELETE. Pass SQL as a string with a params array bound to positional placeholders like $1, and the FDC CLI validates the SQL at deploy time via firebase deploy --only dataconnect. _Developers weighing GraphQL versus raw SQL tradeoffs can track backend platform changes like this on daily.dev._ ### What is the difference between Native SQL and the @view directive in Firebase Data Connect? Native SQL provides full read and write flexibility with dynamic JSON (Any type) returns, useful for complex aggregations, window functions, and CTEs, but sacrifices client-side type safety. The @view directive backs a strictly-typed GraphQL OBJECT with a custom SELECT statement, making it ideal for stable, read-only queries where you still want a typed result on the client, though views cannot be mutated and lack primary keys. _Teams deciding between typed views and raw SQL access can compare backend data patterns on daily.dev._ ### How does Firebase Data Connect prevent SQL injection when using Native SQL? SQL statements in Native SQL are hardcoded in deployed .gql files so clients cannot send arbitrary SQL at runtime, and the FDC CLI performs deploy-time validation that rejects destructive DDL commands. Inputs pass through a params array bound to positional placeholders ($1, $2) by the database driver rather than string concatenation, and server-side context injection via {_expr: "auth.uid"} prevents client-side spoofing of authorization fields. _Developers hardening database access patterns can follow security-relevant backend updates on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#sql](https://daily.dev/tags/sql), [#postgresql](https://daily.dev/tags/postgresql), [#graphql](https://daily.dev/tags/graphql), [#firebase](https://daily.dev/tags/firebase) [View this post on daily.dev](https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Writing SQL in SQL Connect","url":"https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4"},"datePublished":"2026-08-23T12:19:36.451Z","dateModified":"2026-08-24T06:58:31.978Z","description":"Firebase Data Connect (now called SQL Connect) launches Native SQL, a feature allowing developers to write raw SQL directly inside .gql operation files while...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/eea0602c670065fcb4e5a2e8ee3d8885?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/eea0602c670065fcb4e5a2e8ee3d8885?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Firebase","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Firebase","logo":"https://media.daily.dev/image/upload/s--i395oqZH--/f_auto,q_auto/v1787487448/logos/firebase-blog?_a=BAMAMicg0","url":"https://daily.dev/sources/firebase-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,sql,postgresql,graphql,firebase","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Firebase","item":"https://daily.dev/sources/firebase-blog"},{"@type":"ListItem","position":3,"name":"Writing SQL in SQL Connect"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/writing-sql-in-sql-connect-ycdviske4#faq","mainEntity":[{"@type":"Question","name":"How do I run raw SQL queries in Firebase Data Connect instead of GraphQL operations?","acceptedAnswer":{"@type":"Answer","text":"Native SQL for Data Connect lets you define operations using raw SQL syntax directly in your .gql operation files via new root fields on the query and mutation types. Use _select or _selectFirst for read queries and _execute, _executeReturning, or _executeReturningFirst for DML like INSERT, UPDATE, and DELETE. Pass SQL as a string with a params array bound to positional placeholders like $1, and the FDC CLI validates the SQL at deploy time via firebase deploy --only dataconnect. Developers weighing GraphQL versus raw SQL tradeoffs can track backend platform changes like this on daily.dev."}},{"@type":"Question","name":"What is the difference between Native SQL and the @view directive in Firebase Data Connect?","acceptedAnswer":{"@type":"Answer","text":"Native SQL provides full read and write flexibility with dynamic JSON (Any type) returns, useful for complex aggregations, window functions, and CTEs, but sacrifices client-side type safety. The @view directive backs a strictly-typed GraphQL OBJECT with a custom SELECT statement, making it ideal for stable, read-only queries where you still want a typed result on the client, though views cannot be mutated and lack primary keys. Teams deciding between typed views and raw SQL access can compare backend data patterns on daily.dev."}},{"@type":"Question","name":"How does Firebase Data Connect prevent SQL injection when using Native SQL?","acceptedAnswer":{"@type":"Answer","text":"SQL statements in Native SQL are hardcoded in deployed .gql files so clients cannot send arbitrary SQL at runtime, and the FDC CLI performs deploy-time validation that rejects destructive DDL commands. Inputs pass through a params array bound to positional placeholders ($1, $2) by the database driver rather than string concatenation, and server-side context injection via {_expr: \"auth.uid\"} prevents client-side spoofing of authorization fields. Developers hardening database access patterns can follow security-relevant backend updates on daily.dev."}}]} ```