| 用途 | SQL 复用与参数化 |
|---|---|
| SQL 层 | PREPARE stmt FROM '…' / EXECUTE / DEALLOCATE PREPARE |
| 应用层 | PDO / JDBC / ORM 占位符 |
SQL 层示例
SQL 层示例
PREPARE stmt FROM 'SELECT id, sku FROM orders WHERE user_id = ? LIMIT ?';
SET @uid = 42, @n = 10;
EXECUTE stmt USING @uid, @n;
DEALLOCATE PREPARE stmt;应用层（参数化防注入）
应用层（参数化防注入）
cur.execute('SELECT * FROM users WHERE name = %s AND status = %s', (name, status))服务端 prepared statement 在连接内有效，连接池中的使用要注意会话隔离。