Parameterised queries

Use prepared statements.

Parameterized query

A parameterized query keeps the value separate from the SQL body. The $1 placeholder carries data safely; EXECUTE supplies the value.

PREPARE check_user(text) AS
SELECT * FROM users WHERE email = $1;
EXECUTE check_user('a@b.com');

A parameterized query separates the value.

All columns are selected from users. WHERE keeps only the rows where email = $1 holds.

Parameterized query — details

The prepared plan is cached; repeated queries gain both speed and safety. The parameter count and types are set in PREPARE, values are given in order in EXECUTE.

Exercise Parameterized query

Run the prepared check_user with the value 'a@b.com'.

Show example solution

EXECUTE check_user('a@b.com');

Test yourself

Execute the query

____ check_user('a@b.com');

Show answer

EXECUTE check_user('a@b.com');

What does $1 represent?
- The table name
- An index name
- A parameter placeholder
- The column name
Show answer

A parameter placeholder — $1 is a parameter placeholder.
Parameterised queries: match the terms

parameter

parameter
placeholder

placeholder
EXECUTE

execute
cache

cache

Next lesson: Authorisation

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies