Prepared Statements for Database driven application

Prepared Statement is commonly used by application to execute the same parameterized SQL statement again and again. Prepared statements are compiled only once. If we need to execute a statement multiple times then execution of prepared statement is faster as it is compiled only once, while in case if we are using direct statements then each statement is first compiled every time before execution. So, time taken in Prepared execution is lesser as compared to the time taken in direct execution.

Prepared statement are also known as parameterized queries. Parameterized queries and prepared statements are features of database management systems that basically act as templates in which SQL can be executed.

Example of Prepared Statement using Java and C#

We are using Emp table. Here "id" is the primary key of the table. Following query will retrive all the data of a row for id =1
SELECT * FROM Emp WHERE id =1

Now, if we create a template of above statement and use that for multiple values of "id" then it will look like -

SELECT * FROM Emp WHERE id = ? 

Here "?" is called Placeholder. It represents the place where actual values will be used in the SQL query. Placeholders are also known as bound parameters, since they are essential parameters that are passed to SQL that "bind" to the SQL at a later time.

Prepared statment in JDBC-

java.sql.PreparedStatement stmt =
connection.prepareStatement("SELECT * FROM Emp WHERE id = ?");

for (int i = 1; i<= 100; i++)
{
        stmt.setString(i, id);
        stmt.executeQuery();
}



Parameterized statements in SQL Server using C#

String sql = "SELECT * FROM Emp WHERE id = @id";
for(int i =1; i<=100; i++)
{
        cmd.Parameters.AddWithValue("@id", i);
       //execution of cmd

        cmd.Parameters.Clear();
}

In the above code, cmd is SqlCommand object
CodeProject