Explore practical examples of prepared statements. Learn how to use them to enhance application security against SQL injection and improve query performance by optimizing statement execution.
Field types are used in the MYSQL_BIND structure and represent the type of the fields. Field types are defined in mariadb_com.h
.
MYSQL_TYPE_BIT
MYSQL_TYPE_BLOB
MYSQL_TYPE_DATE
MYSQL_TYPE_DATETIME
MYSQL_TYPE_DECIMAL
MYSQL_TYPE_DOUBLE
MYSQL_TYPE_ENUM
MYSQL_TYPE_FLOAT
MYSQL_TYPE_GEOMETRY
MYSQL_TYPE_INT24
MYSQL_TYPE_JSON
MYSQL_TYPE_LONG
MYSQL_TYPE_LONGLONG
MYSQL_TYPE_LONG_BLOB
MYSQL_TYPE_MEDIUM_BLOB
MYSQL_TYPE_NEWDATE
MYSQL_TYPE_NEWDECIMAL
MYSQL_TYPE_NULL
MYSQL_TYPE_SET
MYSQL_TYPE_SHORT
MYSQL_TYPE_STRING
MYSQL_TYPE_TIME
MYSQL_TYPE_TIMESTAMP
MYSQL_TYPE_TINY
MYSQL_TYPE_TINY_BLOB
MYSQL_TYPE_VARCHAR
MYSQL_TYPE_VAR_STRING
MYSQL_TYPE_YEAR
Indicator variables store supplementary information which will be sent to the server.
STMT_INDICATOR_NONE
no indicator (=0)
STMT_INDICATOR_NTS
(string) buffer is null/zero terminated string
STMT_INDICATOR_NULL
buffer is null
STMT_INDICATOR_DEFAULT
use columns default value
STMT_INDICATOR_IGNORE
do not update column value
The MYSQL_BIND
structure is used to bind parameters (which will be sent to the server) and result sets (output sent from server to client). The MYSQL_BIND
structure is bound with mysql_stmt_bind_param() or mysql_stmt_bind_result() to a prepared statement.
enum enum_field_types
field_type: Type of the buffer for in- or output. For a complete list of types see the types and definitions section.
void
buffer: Address of a variable, array or structure used for data transfer.
unsigned long
buffer_length: Size of buffer in bytes.
unsigned long *
length: Pointer to a length variable for output or array of length elements for input (array binding).
my_bool *
error: Pointer to an error variable for output.
my_bool *
is_null: Pointer to a null indicator for output.
char *
u.indicator: Array of indicator variables for input (array binding)
my_bool
is_unsigned: Set when numeric data type is unsigned
Array binding for bulk insert/updates was introduced with Connector/C 3.0 and requires MariaDB 10.2 or above. It allows clients to control the number of rows that will be physically transferred between the server and the client in one logical bind or fetch. This can greatly improve the performance of many applications by trading buffer space for time (network traffic) and is a better and more secure alternative to LOAD DATA LOCAL INFILE
, especially when the data will be generated within application.
Indicator variables are used to represent special semantics like NULL or DEFAULT values.
Indicator variable
Description
STMT_INDICATOR_NTS
String is null terminated
STMT_INDICATOR_NONE
No semantics
STMT_INDICATOR_NULL
NULL value
STMT_INDICATOR_DEFAULT
Use columns default value
STMT_INDICATOR_IGNORE
Skip update of column
When using column wise binding (the default) the application binds up to 3 arrays to a column: a data array, a length array and optionally an indicator array.
The number of rows has to be set by calling mysql_stmt_attr_set() with the STMT_ATTR_ARRAY_SIZE
option:
unsigned int array_size= 100;
mysql_stmt_attr_set(stmt, STMT_ATTR_ARRAY_SIZE, array_size);
Each array contains as many elements as specified in the array_size
parameter.
An example for column wise binding can be found here.
When using row wise binding the application binds up to 3 elements of a structure to a column: a data element, a length element and an optional indicator element.
The application declares the size of the structure with the STMT_ATTR_ROW_SIZE
attribute and binds the address of each member in the first element of the array:
unsigned int row_size= sizeof(struct my_data);
mysql_stmt_attr_set(stmt, STMT_ATTR_ROW_SIZE, &row_size);
Connector/C can now calculate the address of the data for a particular row and column asaddress= bind_address + row_nr * row_size
where rows are numbered from 0 to size of rowset - 1.
If row_size
is zero, column wise binding will be used instead.
An example for row wise binding can be found here.
The MYSQL_STMT
structure is a handle for a prepared statement. The handle will be allocated by mysql_stmt_init() and released by mysql_stmt_close().
All members of MYSQL_STMT
are private and not intended for application use.
Multiple statement handles can be opened within the same connection.
After a successful call to mysql_stmt_prepare() a prepared statement will also allocate resources on the server.
Closing the connection with mysql_close() invalidates the statements but doesn't free resources on the client.