《数据库系统概念》课件-第五章.pptVIP

ODBC Prepared Statements Prepared Statement SQL statement prepared: compiled at the database Can have placeholders: E.g. insert into account values(?,?,?) Repeatedly executed with actual values for the placeholders To prepare a statement SQLPrepare(stmt, SQL String); To bind parameters  SQLBindParameter(stmt, parameter#,  … type information and value omitted for simplicity..) To execute the statement retcode = SQLExecute( stmt); To avoid SQL injection security risk, do not create SQL strings directly using user input; instead use prepared statements to bind user inpu