3 ms·
I am not the original poster, but some queries can't be moved to stored procedures (depends on SQL software and library abilities). For example: IN clauses can
by adamzochowski 9y ago
I am not the original poster, but some queries can't be moved to stored procedures (depends on SQL software and library abilities). For example:
IN clauses can get tricky if prepared statements don't support arrays / lists of columns.
Adhoc queries get tricky where user could specify a parameter or not.
This answer is more about stored procedures than prepared statements.
- deleted 9y ago[deleted]
- aeronautic 9y agoThat is right. The key point is to reduce exposure to SQL injection by not formatting queries. Prepared statements help solve a whole class of bugs at a lower level.