Isn’t that what prepared statements basically are?
[deleted]
Ask HN: Why aren't SQL queries compiled?
11–13 of 13 posts
Re: Ask HN: Why aren't SQL queries compiled?
#12Prepared statements are parameterized (avoiding SQL injection) and can pre-compiled (what this really means depends on the implementation.)
This. If you aren't using prepared statements, you're doing it wrong.
I once worked on a system where the original developer, supposedly with 25+ years experience, did not know about prepared statements. He had developed his own home grown "ORM" that attempted to manually escape SQL. You can guess how well that worked out. We'd get SQL 'syntax errors' in production regularly.
Re: Ask HN: Why aren't SQL queries compiled?
#13It’s a declarative language and it’s compiled into an execution "plan", and parameterised queries (bind variables, prepared statements, whatever you want to call them) are passed at runtime.
When you dynamically build queries by concatenation you bypass this compilation phase (parse, compute plan, etc.), and spend unnecessary time on near identical queries.
If you want many more gory details, this is a good watch: https://youtu.be/eurwtUhY5fk