3 ms·

Prepared statements don't handle all cases, e.g. "ORDER BY :?" doesn't work.

• yogo 13y ago
  I think you can add your own kind of preparation/binding on top of the db engine's binding by introducing a little syntax for those cases. Basically what I'm saying is to properly sanitize what gets inserted then perform a string replace on the query string. It comes in handy for other clauses that normal binding does not cover. An example would be you would have your binding take care of something like :foo: as a sort of preprocessing before the db takes care of the others like :foo
• chiph 13y ago
  Another example (SQL Server specific, perhaps) is parameterizing the COLLATE option. You just can't do it, so you have to string-concat it, which means that your query cache has n versions of each query, where n is the number of locales your app supports. Good thing RAM is cheap.