Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is parameterized query?

What is a parameterized query, and what would an example of such a query be in PHP and MySQL?

like image 806
totalnoobs Avatar asked Jan 17 '11 10:01

totalnoobs


People also ask

What is parameterized query with example?

A parameterized query is a query in which placeholders are used for parameters and the parameter values are supplied at execution time. The most important reason to use parameterized queries is to avoid SQL injection attacks.

What is a parameterized query in a SQL statement?

Parameterized SQL queries allow you to place parameters in an SQL query instead of a constant value. A parameter takes a value only when the query is executed, which allows the query to be reused with different values and for different purposes.

What is a parametric query?

A parameter query is one of the simplest and most useful advanced queries you can create. It allows you to create a query that can be updated easily to reflect a new search term. When you open a parameter query, Access will prompt you for a search term and then show you query results that reflect your search.

What is parameterized query in mysql?

A parameterized query is a query in which placeholders ( %s ) are used for parameters (column values) and the parameter values supplied at execution time.


2 Answers

A parameterized query (also known as a prepared statement) is a means of pre-compiling a SQL statement so that all you need to supply are the "parameters" (think "variables") that need to be inserted into the statement for it to be executed. It's commonly used as a means of preventing SQL injection attacks.

You can read more about these on PHP's PDO page (PDO being a database abstraction layer), although you can also make use of them if you're using the mysqli database interface (see the prepare documentation).

like image 118
John Parker Avatar answered Sep 22 '22 12:09

John Parker


This is a clear and succinct explanation of what it is, and how it works. How and Why to use Parameterization [archive link] (since the original link is dead)

Essential the process involves the server preprocessing the request without parameters so it knows the type of query it is. So, for example a SELECT query is only a SELECT query, and cannot be concatenated by a parameter(request variable) to be a SELECT / DROP or some other MySql injection. Instead the injection data will be just string data in the parameter field.

like image 32
Paul V Avatar answered Sep 23 '22 12:09

Paul V