Problem Solution Discussion Using Prepared Statements and Placeholders in Queries

• JDBC 2 int roduces t he concept of a scrollable result set , along wit h m et hods for m oving back and fort h am ong rows. This is not present in earlier versions of JDBC, alt hough t he MySQL Connect or J driver does happen t o support next and previous m et hods even for JDBC 1.12. Whet her or not a part icular dat abase- access API allows rewinding and posit ioning, your program s can achieve random access int o a result set by fet ching all rows from a result set and saving t hem int o a dat a st ruct ure. For exam ple, you can use a t wo-dim ensional array t hat st ores result rows and colum ns as elem ent s of a m at rix. Once youve done t hat , you can it erat e t hrough t he result set m ult iple t im es or use it s elem ent s in random access fashion however you please. I f your API provides a call t hat ret urns an ent ire result set in a single operat ion, it s relat ively t rivial t o generat e a m at rix. Perl and Pyt hon can do t his. Ot herwise, you need t o run a row- fet ching loop and save t he rows yourself.

2.7 Using Prepared Statements and Placeholders in Queries

2.7.1 Problem

You want t o writ e queries t hat are m ore generic and dont refer t o specific dat a values, so t hat you can reuse t hem .

2.7.2 Solution

Use your API s placeholder m echanism , if it has one.

2.7.3 Discussion

One way t o const ruct SQL st at em ent s from wit hin a program is t o put dat a values lit erally int o t he query st ring, as in t hese exam ples: SELECT FROM profile WHERE age 40 AND color = green INSERT INTO profile name,color VALUESGary,blue Som e API s provide an alt ernat ive t hat allows you t o specify query st rings t hat do not include lit eral dat a values. Using t his approach, you writ e t he st at em ent using placeholders—special charact ers t hat indicat e where t he values go. One com m on placeholder charact er is ? , so t he previous queries m ight be rewrit t en t o use placeholders like t his: SELECT FROM profile WHERE age ? AND color = ? INSERT INTO profile name,color VALUES?,? For API s t hat support t his kind of t hing, you pass t he st ring t o t he dat abase t o allow it t o prepare a query plan. Then you supply dat a values and bind t hem t o t he placeholders when you execut e t he query. You can reuse t he prepared query by binding different values t o it each t im e it s execut ed. One of t he benefit s of prepared st at em ent s and placeholders is t hat param et er binding operat ions aut om at ically handle escaping of charact ers such as quot es and backslashes t hat you have t o worry about yourself if you put t he dat a values int o t he query yourself. This can be especially useful if youre insert ing binary dat a such as im ages int o your dat abase, or using dat a values wit h unknown cont ent such as input subm it t ed by a rem ot e user t hrough a form in a web page. Anot her benefit of prepared st at em ent s is t hat t hey encourage st at em ent reuse. St at em ent s becom e m ore generic because t hey cont ain placeholders rat her t han specific dat a values. I f youre execut ing an operat ion over and over, you m ay be able t o reuse a prepared st at em ent and sim ply bind different dat a values t o it each t im e you execut e it . I f so, you gain a perform ance benefit , at least for dat abases t hat support query planning. For exam ple, if a program issues a part icular t ype of SELECT st at em ent several t im es while it runs, such a dat abase can const ruct a plan for t he st at em ent , t hen reuse it each t im e, rat her t han rebuilding t he plan over and over. MySQL doesnt build query plans, so you dont get any perform ance boost from using prepared st at em ent s. However, if you port a program t o a dat abase t hat does use query plans, youll gain t he advant age of prepared st at em ent s aut om at ically if youve writ t en your program from t he out set t o use t hem . You wont have t o convert from non- prepared st at em ent s t o enj oy t hat benefit . A t hird benefit is t hat code t hat uses placeholder- based queries can be easier t o read, alt hough t hat s som ewhat subj ect ive. As you read t hrough t his sect ion, you m ight com pare t he queries used here wit h t hose from t he previous sect ion t hat did not use placeholders, t o see which you prefer.

2.7.4 Perl