AQL: 3. Rules for parameter substitution on AQL: which types will add or not quotes

There was another topic about this: AQL: Clarify use of parameters in AQL queries

As suggested there, the option-1 " ... WHERE c/archetype_node_id=’$archetype_id’ ... " is (or might be) unsafe against SQL injection. It is going to work but, is considered bad practice.

For backward compatibility we should still support it, with an appropriate notice in the spec about related risks. More important is what should we should facilitate and promote: it is actually the option-2, where the parameters are substituted by the engine in a smart way, depending on expected types. This is also done by most of the SQL engines (if I’m not mistaken).