Prepared Statements
MySQL 8.0 provides support for server-side prepared statements. This support takes advantage of the efficient client/server binary protocol. Using prepared statements with placeholders for parameter values has the following benefits:
- Less overhead for parsing the statement each time it is executed. Typically, database applications process large volumes of almost-identical statements, with only changes to literal or variable values in clauses such as
WHERE for queries and deletes, SET for updates, and VALUES for inserts.
- Protection against SQL injection attacks. The parameter values can contain unescaped SQL quote and delimiter characters.
In order to use MySQL prepared statement, you use three following statements:
PREPARE – prepare a statement for execution.EXECUTE – execute a prepared statement prepared by the PREPARE statement.DEALLOCATE PREPARE – release a prepared statement.
The following diagram illustrates how to use a prepared statement:
...
