So, my previous entry which contained a performance tip regarding the use of prepared statements got a few good comments, and prompted me to write a follow-up post summarizing the various comments and expanding a bit on the problems with using prepared statements.
What Are Prepared Statements, Anyway?
OK, so the concept of prepared statements have been around for quite some time. The basic advantages of prepared statements (from a conceptual point of view, not necessarily a realistic point of view for MySQL) are that SQL statement parameters — in other words, the WHERE, INSERT or UPDATE SET constants supplied to the SQL statement — can be represented by a token, such as "?", and at run-time, the tokens are replaced with actual parameters after being escaped. The escaping of the variables is important to mitigate the threat of certain security attacks, such as SQL injection. Additionally, in theory, the prepared …
[Read more]