4 ms·
What difference does using prepared statements make?
by weavie 8y ago
What difference does using prepared statements make?
- skunkworker 8y agoYou can avoid SQL injection. It makes it harder to shoot yourself in the foot, though still possible to inject if your prepared statement includes a string interpolated variable.
- weavie 8y agoYes, good point.
- qaq 8y agoYou have abstraction between your code and DB you can change underlying tables but interface will remain consistent requiring no changes to the application. There are security benefits too easier to prevent SQL Injection, you also only give the app user permission to execute sps so no arbitrary queries can be run.