SET @var = "some input";
EXECUTE qry USING @var;
SET @var = "some other input";
EXECUTE qry USING @var;
在PHP中使用时，通常是这样的（缩写）：
$stmt = prepare('INSERT INTO tbl VALUES(?)');
execute($stmt, array("some input"));
execute($stmt, array("some other input"));
execute($stmt, array("some more input"));
A parameterized query is essentially a query which abstracts away all the input. This has several good side effects, like making all input harmless (ie. no harmful injections are possible) and making it faster when used repeatedly, since it is pre-parsed and compiled, so the engine knows how to apply the input given. An example in pure mysql is:
PREPARE qry FROM "INSERT INTO tbl VALUES (?)";
The statement is now compiled and cached, and can be executed repeatedly without needing to recompile and interpret it:
SET @var = "some input";
EXECUTE qry USING @var;
SET @var = "some other input";
EXECUTE qry USING @var;
When used in PHP, it's usually like this (shortened):
$stmt = prepare('INSERT INTO tbl VALUES(?)');
execute($stmt, array("some input"));
execute($stmt, array("some other input"));
execute($stmt, array("some more input"));
发布评论
评论（2）
参数化查询本质上是一种抽象出所有输入的查询。这有几个好的副作用，例如使所有输入无害（即不可能进行有害注入）并使其在重复使用时速度更快，因为它是预先解析和编译的，因此引擎知道如何应用给定的输入。纯mysql中的一个例子是：
该语句现在已编译并缓存，并且可以重复执行，无需重新编译和解释它：
在PHP中使用时，通常是这样的（缩写）：
A parameterized query is essentially a query which abstracts away all the input. This has several good side effects, like making all input harmless (ie. no harmful injections are possible) and making it faster when used repeatedly, since it is pre-parsed and compiled, so the engine knows how to apply the input given. An example in pure mysql is:
The statement is now compiled and cached, and can be executed repeatedly without needing to recompile and interpret it:
When used in PHP, it's usually like this (shortened):
来源：MySQL 开发：准备好的语句
Source: MySQL Dev: Prepared Statements