开发者

real_escape_string vs. prepared statements

开发者 https://www.devze.com 2023-01-09 13:53 出处:网络
is there any reason to use one over th开发者_如何转开发e other in terms of speed and safety? Thanks!Speed:

is there any reason to use one over th开发者_如何转开发e other in terms of speed and safety? Thanks!


Speed:

  • When you use bind parameters you can reuse the same query and query plan, just changing the parameters. When you build a query from strings the database has to reparse the statement.
  • With bind parameters the SQL parser also has less work to do. The parameters aren't escaped so the parsing is simpler.

Safety:

  • In my opinion, it is much easier to remember to use parameters than to remember to escape strings.
0

精彩评论

暂无评论...
验证码 换一张
取 消