Use parameterised query option in SQL chunk

DESCRIPTION

@@ -16,6 +16,7 @@ Authors@R: c(
     person("Ben", "Baumer", role = "ctb"),
     person("Brian", "Diggs", role = "ctb"),
     person("Brian", "Zhang", role = "ctb"),
+    person("Bulat", "Yapparov", role = "ctb"),
     person("Cassio", "Pereira", role = "ctb"),
     person("Christophe", "Dervieux", role = "ctb"),
     person("David", "Hall", role = "ctb"),

NEWS.md

@@ -4,6 +4,8 @@
 
 - Exported the internal functions `sew()` (previously named `wrap()`) and `is_low_change()` to make it possible for other graphics systems such as **rgl** to work in **knitr** like base and grid graphics in base R (thanks, @dmurdoch, #1892 #1853).
 
+- For `sql` code chunks, parameterized queries will be executed through native database api if the chunk option `params` is provided (thanks, @byapparov, #1987).
+
 ## BUG FIXES
 
 - Reverted the fix for #1595 since it caused problems in **kableExtra** (thanks, @bttomio, haozhu233/kableExtra#607), and applied a different fix to the original problem (i.e., add `{}` before `[`).

R/engine.R

@@ -543,6 +543,7 @@ eng_sql = function(options) {
   if (is.na(max.print) || is.null(max.print))
     max.print = -1
   sql = one_string(options$code)
+  params = options$params
 
   query = interpolate_from_env(conn, sql)
   if (isFALSE(options$eval)) return(engine_output(options, query, ''))
@@ -558,8 +559,14 @@ eng_sql = function(options) {
       data = DBI::dbFetch(res, n = max.print)
       DBI::dbClearResult(res)
       data
+
     } else {
-      DBI::dbGetQuery(conn, query)
+      if (length(params) == 0) {
+        DBI::dbGetQuery(conn, query)
+      } else {
+        # If params option is provided, parameters are not interplolated
+        DBI::dbGetQuery(conn, sql, params = params)
+      }
     }
   }, error = function(e) {
     if (!options$error) stop(e)