You have a database in an Azure Cosmos DB Core (SQL) API account.

Azure Cosmos DB supports queries with parameters expressed by the familiar @ notation. Parameterized SQL provides robust handling and escaping of user input, and prevents accidental exposure of data through SQL injection.

For example, you can write a query that takes lastName and address.state as parameters, and execute it for various values of lastName and address.state based on user input.

SELECT *

FROM Families f

WHERE f.lastName = @lastName AND f.address.state = @addressState