From 14e88f268ccb38883d7d40b5240f68877c55a631 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:25:57 +0000
Subject: [PATCH 1/2] Initial plan


From c886f175feb4051574d6f6c5efd96994ed53eace Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 17:28:49 +0000
Subject: [PATCH 2/2] fix(update): bind params for subqueries in update where

Co-authored-by: mathiasrw <1063454+mathiasrw@users.noreply.github.com>
---
 src/74update.js |  1 +
 test/test684.js | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 test/test684.js

diff --git a/src/74update.js b/src/74update.js
index c189bd2c9b..78034830f9 100755
--- a/src/74update.js
+++ b/src/74update.js
@@ -82,6 +82,7 @@ yy.Update.prototype.compile = function (databaseid) {
 
 	var statement = function (params, cb) {
 		var db = alasql.databases[databaseid];
+		self.params = params;
 
 		//		console.log(db.engineid);
 		//		console.log(db.engineid && alasql.engines[db.engineid].updateTable);
diff --git a/test/test684.js b/test/test684.js
new file mode 100644
index 0000000000..3d9e55ef87
--- /dev/null
+++ b/test/test684.js
@@ -0,0 +1,41 @@
+if (typeof exports === 'object') {
+	var assert = require('assert');
+	var alasql = require('..');
+}
+
+let testId = '684';
+
+describe(`Test ${testId} - update subquery parameter binding`, function () {
+	before(function () {
+		alasql('create database test' + testId);
+		alasql('use test' + testId);
+	});
+
+	after(function () {
+		alasql('drop database test' + testId);
+	});
+
+	it('should bind parameters inside subquery in UPDATE WHERE clause', function () {
+		let res = [];
+		res.push(alasql('CREATE TABLE one ([Field1] STRING, [Field2] INT, [Field3] STRING)'));
+		res.push(alasql("INSERT INTO one VALUES ('Old',10,'aaa'),('Old',10,'bbb'),('Old',20,'ccc')"));
+		res.push(
+			alasql(
+				"UPDATE one SET [Field1] = 'New' WHERE [Field2] = (SELECT [Field2] FROM one WHERE [Field3] = ?)",
+				['aaa']
+			)
+		);
+		res.push(alasql('SELECT [Field1],[Field2],[Field3] FROM one ORDER BY [Field2],[Field3]'));
+
+		assert.deepStrictEqual(res, [
+			1,
+			3,
+			2,
+			[
+				{Field1: 'New', Field2: 10, Field3: 'aaa'},
+				{Field1: 'New', Field2: 10, Field3: 'bbb'},
+				{Field1: 'Old', Field2: 20, Field3: 'ccc'},
+			],
+		]);
+	});
+});