MySQL DatabaseLesson 64Free preview
MySQL Prepared Statements
This lesson is part of MySQL · All levels
Summary
A prepared statement is a mechanism where a query is set with a placeholder and then executed multiple times with different parameter values. Parametric values are always treated as data, not syntax, thus being a primary defense against SQL injection. MySQL supports placeholder question mark (?) both through the PREPARE/EXECUTE syntax and library clients such as PDO and MySQLi.
Key points
- Query is compiled once with a placeholder, the value is tied separately
- The syntax of the server: Prepare, then execute... use, then deal with Prepare.
- Avoid SQL injection because the parameters are never part of the syntax
- It's perfect for repeated query because the execution plan can be reused.
- Libraries such as PDO and MySQLi provide API prepared statement ready for use
Full lesson
Code examples and quizzes
Full lessons, code examples, and quizzes are available to subscribers. 5 questions.