Feature Request: Support parameters (bindings) in statements that cannot be prepared

[mbostock]

I want to create a VIEW whose definition depends on one or more dynamic JavaScript values. To avoid potential SQL injection problems, I would like these dynamic values to be interpolated into the query as parameters (using ?) rather than escaping the SQL manually.

I therefore tried the following query (using the DuckDBClient wrapper of the DuckDB-Wasm library):

CREATE OR REPLACE VIEW top_days AS
SELECT *
FROM aapl
ORDER BY Volume DESC
LIMIT ${limit}

However this fails with the following error:

Binder Error: Unexpected prepared parameter. This type of statement can't be prepared!

If a CREATE VIEW statement cannot be prepared, and the normal connection.query method (for non-prepared statements) does not support parameters, is there any way to pass query parameters safely? It seems that I am required to escape manually.