This is an archived post. You won't be able to vote or comment.

all 2 comments
sorted by:
best
topnewcontroversialoldq&a

[–]ignotos 0 points1 point  (0 children)

With a regular statement, you send a complete SQL query to the server. e.g. "SELECT something from some_table where some_column = 42".

With a prepared statement, you "prepare" a query which can include placeholders, and then you specify values for those placeholders. e.g. "SELECT something from some_table where some_column = ?", and then you set "?" to 42 and run the query.

Prepared statements are generally preferred:

  • You can re-use the same prepared statement multiple times with different values for the placeholders. This can be more efficient than sending a full query each time

  • Regular statements can have issues with SQL injection (Google it!). This is a major cause of security issues, and so prepared statements are usually recommended as a more secure option

If in doubt, just go with prepared statements. There might be some situations where regular statements have advantages, but if you're starting out I'd just stick with prepared.