Mysql – Benefits of using prepared statements in stored procedures

innodbMySQLprepared-statementsql-injectionstored-procedures

Except from helping avoid SQL injection, what are the benefits – if any – of using prepared statements inside a stored procedure (assume query is only executed once in the procedure)?

Does the engine have any way to keep the prepared statement in memory or is it a wash?

If the answer is depending upon environment, I interested in mysql with innodb.

Best Answer

So yes as you have mentioned about SQL injection the other advantage is what you guessed.

Quoting from documentation:

Using prepared statements with placeholders for parameter values has the following benefits:

  • Less overhead for parsing the statement each time it is executed. Typically, database applications process large volumes of almost-identical statements, with only changes to literal or variable values in clauses such as WHERE for queries and deletes, SET for updates, and VALUES for inserts.

  • Protection against SQL injection attacks. The parameter values can contain unescaped SQL quote and delimiter characters.

So yes it does cache the prepared statements and routines.