Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What does a question mark represent in SQL queries? [duplicate]

People also ask

What does question mark mean in SQL query?

A dynamic parameter is a parameter to an SQL statement for which the value is not specified when the statement is created. Instead, the statement has a question mark (?) as a placeholder for each dynamic parameter. See Dynamic parameters. Dynamic parameters are permitted only in prepared statements.

What is question mark in mysql query?

The question mark represents a parameter that will later be replaced. Using parameterized queries is more secure than embedding the parameters right into the query. SQL Server calls this parameterize queries, and Oracle calls it bind variables.

How do you escape a question mark in SQL?

Use a backslash character \ to escape the question mark.

What is question mark in PostgreSQL?

In JDBC, the question mark ( ? ) is the placeholder for the positional parameters of a PreparedStatement . There are, however, a number of PostgreSQL operators that contain a question mark.


What you are seeing is a parameterized query. They are frequently used when executing dynamic SQL from a program.

For example, instead of writing this (note: pseudocode):

ODBCCommand cmd = new ODBCCommand("SELECT thingA FROM tableA WHERE thingB = 7")
result = cmd.Execute()

You write this:

ODBCCommand cmd = new ODBCCommand("SELECT thingA FROM tableA WHERE thingB = ?")
cmd.Parameters.Add(7)
result = cmd.Execute()

This has many advantages, as is probably obvious. One of the most important: the library functions which parse your parameters are clever, and ensure that strings are escaped properly. For example, if you write this:

string s = getStudentName()
cmd.CommandText = "SELECT * FROM students WHERE (name = '" + s + "')"
cmd.Execute()

What happens when the user enters this?

Robert'); DROP TABLE students; --

(Answer is here)

Write this instead:

s = getStudentName()
cmd.CommandText = "SELECT * FROM students WHERE name = ?"
cmd.Parameters.Add(s)
cmd.Execute()

Then the library will sanitize the input, producing this:

"SELECT * FROM students where name = 'Robert''); DROP TABLE students; --'"

Not all DBMS's use ?. MS SQL uses named parameters, which I consider a huge improvement:

cmd.Text = "SELECT thingA FROM tableA WHERE thingB = @varname"
cmd.Parameters.AddWithValue("@varname", 7)
result = cmd.Execute()

The ? is an unnamed parameter which can be filled in by a program running the query to avoid SQL injection.


The ? is to allow Parameterized Query. These parameterized query is to allow type-specific value when replacing the ? with their respective value.

That's all to it.

Here's a reason of why it's better to use Parameterized Query. Basically, it's easier to read and debug.


It's a parameter. You can specify it when executing query.


I don't think that has any meaning in SQL. You might be looking at Prepared Statements in JDBC or something. In that case, the question marks are placeholders for parameters to the statement.


It normally represents a parameter to be supplied by client.