4 ms·
Prepared statements are parameterized (avoiding SQL injection) and can pre-compiled (what this really means depends on the implementation.)
by icedchai 4y ago
Prepared statements are parameterized (avoiding SQL injection) and can pre-compiled (what this really means depends on the implementation.)
- tuatoru 4y agoThis. If you aren't using prepared statements, you're doing it wrong.
- icedchai 4y agoI once worked on a system where the original developer, supposedly with 25+ years experience, did not know about prepared statements. He had developed his own home grown "ORM" that attempted to manually escape SQL. You can guess how well that worked out. We'd get SQL 'syntax errors' in production regularly.