I already shared a theory note on Prepared or Parameterized statements of Database System.

Prepared or Parameterized Statements in Database System

In this post, I am sharing a practical about prepared statements of MySQL.

You can write or create a prepared statement in MySQL.
But this is not an efficient way because the binary protocol through a prepared statement API is better.

But still, you can write, and even it doesn’t require any other programming, you can directly write in SQL.

You can use a prepared statement for MySQL Client program.
You can also use a prepared statement in a stored procedure for the dynamic SQL approach.

Below is a small practical demonstration on this:

Let’s first create sample table and data.

CREATE TABLE Test
(
   TestNumber INTEGER
   ,TestName VARCHAR(50)
);

INSERT INTO Test 
VALUES (1,'ABC'),(8,'EFG')
,(16,'PQR'),(26,'XYZ'),(41,'XVK');

Create prepared statement:

PREPARE TestStmt FROM 
'SELECT * FROM Test 
WHERE TestNumber=?';

You can see ‘?’ in WHERE clause. This ‘? ‘ means a required parameter.
You can pass the parameter during execution of Prepared Statement.

Execute Prepared Statement:

SET @a = 8;
EXECUTE TestStmt USING @a;

Result is:

---------
8 | 'EFG'
---------

De-allocate prepared statement:

DEALLOCATE PREPARE TestStmt;

You can also set max_prepared_stmt_count this is a system variable to guard creation of too many prepared statements.

In this post, I am sharing a theory about Prepared or Parameterized Statements of the Database Technology.

What is Prepared or Parameterized Statements?

Prepared or Parameterized statement is one of the features of the database system in which same SQL statement repeatedly executes with high efficiency.
The prepared statements are one kind of the Template and used by application with different parameters.

Database System can execute the same SQL statement without doing the parsing, compiling and optimizing again and again.

More characteristic of Prepared or Parameterized Query:

The statement template is prepared and sent to the database system, and database system performs parsing, compiling and optimization on this template and store without executing it.

Some of the parameters like, WHERE clause not passed during the template creation, and later application, send these parameters to the database system and database system use this template and executes as per the query request.

Prepared statements are beneficial against SQL Injection because the application can prepare parameter using different techniques and protocols.

When the number of records are increasing and indexes are changing frequently at that time Prepared Statements might be fail because in this situation new query plan require for each execution.

All different database technology likes, Microsoft SQL Server, PostgreSQL, MySQL, Oracle is supported parametrized statements.

Please check the small practical example of MySQL Prepared statements.

Prepared or Parameterized Statement in MySQL