Questions tagged [prepared-statement]

A Prepared Statement (or parameterized statement) is a precompiled SQL statement that serves to improve performance and mitigate SQL injection attacks. Prepared statements are used in many popular Relational Database Management Systems.

Filter by
Sorted by
Tagged with
1 vote
2 answers
28 views

How to use stored procedure parameters in the execute statement?

I have a simple stored procedure: DELIMITER $$ CREATE PROCEDURE `findUserByName`(IN `name` VARCHAR(36)) BEGIN set @name = name; PREPARE findStmt FROM 'SELECT * FROM user WHERE name=?'; EXECUTE ...
shingo's user avatar
  • 20.2k
1 vote
1 answer
35 views

How to use $wpdb->prepare for dynamic value

I build a sql with dynamic value from a array. How can I use placeholder or that dymanic condition. I'm calling that function like this: get_all_results("TABLE_NAME", ["column" =&...
Karim's user avatar
  • 21
1 vote
1 answer
48 views

Cannot get results Between dates in SQLite using Java PreparedStatement

I have been trying to get data from a table 'produccion' that has a date field called 'dia' using a between statement. The SQL sentence I was aimig for is: SELECT * FROM produccion WHERE julianday(dia)...
Pablo Iglesias's user avatar
0 votes
0 answers
8 views

unprocessedResponseCount < 0 on decrement. Disabling connection resiliency. java

Early I faced with a problem "unprocessedResponseCount < 0 on decrement. Disabling connection resiliency.java" After some time of searching a problem, I didn't find anything about it. ...
ivvasch's user avatar
  • 11
2 votes
1 answer
21 views

Parameterising order column name and sort order for MySQL queries in Ballerina

I need to parameterise the ordering column name and sort order (ASC/DESC) in a sql:ParameterizedQuery. i.e: `SELECT * FROM <TABLE_NAME> ORDER BY ${<COLUMN_NAME>} ${<SORT_ORDER>}` ...
Nadeeshan Dissanayake's user avatar
0 votes
2 answers
69 views

SQLiteConnection parameterized query c#

I am trying to find a solution to this but could find no help anywhere. I have a SqliteConnection object and I to this I m using the query selector to pass a parameterized query but could not find any ...
NewTech's user avatar
  • 324
1 vote
1 answer
41 views

Prisma prepared statement error when running simple query

Lang: Node DB: MySQL ORM: Prisma I have a problem with running this query in prisma. My database contains currently abou 100 000 books. When run this command I get an error: Error occurred during ...
Bohumil Miláček's user avatar
1 vote
0 answers
27 views

Share inserts done via preparedStatement with JPA

I am doing bulk inserts in Java using HikariCP with PreparedStatments. JPA is used as persistence provider. Requirement:- 100K inserts in a table via HikariCP(preparedStatement) Executing native query(...
Ajay Sharma's user avatar
1 vote
2 answers
88 views

How to handle SQL queries to a database with a propability of 100+ combinations?

I have 9 fields to my user interface , each one is representing a column in my database table. So the problem is that i need to cover all the possible combinations of the 9 fields and send specific ...
Νίκος Ανδρεάδης's user avatar
0 votes
0 answers
44 views

Prepared statment using arrays and temp table

I am have this temporary table statement: CREATE TEMP TABLE mytable AS SELECT UNNEST(ARRAY[1, 2, 3]) AS name, UNNEST(ARRAY['a', 'b', 'c']) AS col2; From which I am trying to create a prepared ...
Max888's user avatar
  • 3,225
0 votes
0 answers
17 views

Converting the "Type" of Field, From a "SHOW COLUMNS" query, to a useable prepared statements argument. PHP MYSQL

I am querying my database for the Type of each column, then I am doing a prepared statement, based on the resulting columns. From my query I receive the "Type" of each column, however, ...
wooterthegreat's user avatar
0 votes
0 answers
48 views

Does this custom function prevent sql injection? [duplicate]

I am building a class to run queries and created this method in order to easily run prepared statements throughout my other classes. My main concern was that I currently do not have any regex ...
SamNewton's user avatar
0 votes
0 answers
27 views

Construct prepared sql template with node-mssql in NodeJS

I have an Express app and I'm using the node-mssql library to connect to a mssql DB for retrieving and writing data from it. Now, in the backend of the Express app I want to have a functionality that ...
TheDude's user avatar
  • 1,235
1 vote
0 answers
54 views

MySQL prepared statement significantly slower than query

I'm having a weird situation where running any prepared statement on an AWS RDS MySQL 8.0 instance is significantly (> 100x) slower than running the exact same query manually. For instance PREPARE ...
Martijn's user avatar
  • 3,716
0 votes
1 answer
44 views

ocaml sqlite3 prepared statement

I have the following insert for sqlite3 in ocaml, which works ok. type article = { author : string; content: string } let insert_article db (article: article) = let sql = Printf.sprintf "...
OrderAndChaos's user avatar
0 votes
0 answers
27 views

I have created a PreparedStatement object and when I inspect that element I can see m_type=12. What is this m_type=12

I have created a PreparedStatement object and I passed my SQL query to it. After that I set 9 parameters to that PreparesStatement object by reading an array. When I inspect the PreparesStatement ...
GaneshaS's user avatar
1 vote
0 answers
35 views

How to highlight the search keyword (inject html code) directly in the SQL results using prepared statements?

Edit : my question is not a duplicate of how to highlight search results since i am trying to work with the query and not the query results. I know i could work with the query result and i even tried, ...
Aurélien Grimpard's user avatar
0 votes
1 answer
51 views

How to change SQL query to a parameterized query

let query = select * from (select acf.ID "call_flow_ID", acf.Name "CALL_FLOW_NAME", acf.SLO "SERVICE_OBJECTIVE", acf.LOG_FILTER "LOG_FILTER", acf.Max_jump, (...
Vidya's user avatar
  • 1
0 votes
2 answers
72 views

String concatenation with dollar-quoting

I use concatenation to prepare a query string with parameter values When I use single quotes: p_ReqStr_old := ' with prm as ( select 1::int4 as id, ' || ' to_timestamp(''' || to_char(...
Ivan Vodopyanov's user avatar
-1 votes
1 answer
85 views

java.sql.SQLException: method cannot be called on a PreparedStatement

I would like to connect to SQLite database using SQLite using HikariCP. But I get an error when I try to run a query. Exception in thread "main" java.lang.RuntimeException: java.sql....
SN4K's user avatar
  • 3
1 vote
1 answer
37 views

Is a new ID assigned to a parsed prepared statement if the statement is the same?

Cassandra : When Cassandra assign an id to a parsed statement, will it assign a new id if same statement is issued to different Cassandra node or if the same statement originates from different ...
Amit Wadkar's user avatar
1 vote
1 answer
91 views

Search by JSONB field value. How to prepare query correctly using jooq?

I'm trying to find records by condition from the jsonb field (array). I'm using the jsonb_exists_all function for this. I wrote a working SQL, but I ran into the problem of creating correct Java code (...
Dmtry's user avatar
  • 13
0 votes
0 answers
18 views

Why won't my data push to the table using prepared statement? [duplicate]

I have a table that I am trying to INSERT INTO three different columns (child1Name, dobChild1, ageChild1) using a prepared statement. I can insert the data into this table within phpmyadmin utilizing ...
Joshua Lee's user avatar
0 votes
1 answer
38 views

Can I use prepare statement to create function and stored procedures in mysql?

I need to create a new function and stored procedures through the prepare and execute statement. Whether it is possible or not? prepare statement from 'DELIMITER ;; CREATE FUNCTION `db_name`.`fn_name`(...
Selvakumar M's user avatar
0 votes
1 answer
24 views

I created table in Postgresql which has 4 columns want to authenticate my login from this table of column 1 and 4 but it give c index out of rang [closed]

The following code not working properly in my Servlet PreparedStatement ps=con.prepareStatement("SELECT uname,upass FROM shams WHERE uname=? and upass=? "); ps.setString(1, name); ps....
M Shams's user avatar
  • 11
0 votes
0 answers
37 views

How can I write parameterized ADO.NET SQL queries that are portable between ODBC and SQL Server?

I have a codebase that uses ADO.NET SQL queries using @parameterName to refer to parameters. I need to make this code portable so that it can be run against an OdbcConnection rather than just a ...
ChaseMedallion's user avatar
0 votes
1 answer
98 views

I want to automatically place the ID from the Parent table into a child table

I have two separate tables each will input the form data into the phpmyadmin Db respectively. Users and Parents respectively I am using procedural PHP and a prepared statement for form data. I have ...
Joshua Lee's user avatar
0 votes
2 answers
63 views

Apache AGE. PREPARE. ERROR: function cypher_stored_procedure(unknown) does not exist

According to instructions Apache AGE docs wrote a function: CREATE OR REPLACE FUNCTION sh_univeronto.f_example() RETURNS TABLE(res ag_catalog.agtype) LANGUAGE plpgsql AS $function$ begin ...
kealog's user avatar
  • 11
-1 votes
1 answer
87 views

Postgres PREPARE - what does 'session' mean?

I'm looking at the possibility of using Postgres prepared statements, wondering can they improve performance. (We have to use parameters to safeguard against SQL injection, of course, but prepared ...
rwallace's user avatar
  • 31.8k
0 votes
1 answer
71 views

JDBC- Will the Prepared Statement instantiated in try block and not accessible in finally block be closed once Conn is closed in finally block

It is said that when we close connection object, the preparedstatement, resultset everything gets closed. In existing project code I found that PreparedStatement is not closed explicitly and also it ...
Divya's user avatar
  • 3
-1 votes
1 answer
53 views

Number of bind variables doesn't match number of fields in prepared statement

I have looked over my code and I can't find the error. What is confusing, is that if I remove any one of the variables from the $stmt->bind_result() the above error does not occur, however; I ...
Colin Nolan's user avatar
0 votes
0 answers
97 views

Is it possible in mysql to execute statement without using prepared

I have created the following stored procedure in MySQL 8.0 for dropping functions. I am calling this stored procedure to drop any function: DELIMITER $$ DROP PROCEDURE IF EXISTS `...
jay bhut's user avatar
0 votes
1 answer
25 views

What is the most efficient way to pass multiple unknown number of parameters to the IN clause for a select query?

One of the main requirements is for the query to be not compiled repeatedly. So, we need to use a prepared statement as it will be called from a spring boot application. something like: select * from ...
Siddharth Katiyar's user avatar
0 votes
0 answers
43 views

Oracle sql query returning empty resultset in java code, but working fine in SQL developer

My Query is like this below. select a.actl_empl_cd ,a.actl_yr_nb,a.actl_wk_nb from eng_eplt.empl_actl_tm_sht a where a.actl_yr_nb = (select to_number(to_char(sysdate, 'iyyy')) from dual) AND a....
vignesh waran's user avatar
0 votes
1 answer
57 views

PreparedStatement parameterization triggers deadlocks (JDBC, SQL Server 2019)

Background I am working on a piece of enterprise software for which we've recently decided to move from building SQL queries via string concatenation to doing so by using prepared statements with ...
Nikolai Petrov's user avatar
0 votes
1 answer
61 views

Mysql PreparedStatement Query returns 0 rows though table has newly inserted data

I'm porting an old java program that polls the db every few minutes. It simply queries a certain table and based on the row values processes them (i have to maintain the polling, can't change to CDC ...
Obb's user avatar
  • 163
0 votes
0 answers
56 views

PreparedStatement automatically adds the \

I'm trying to make a query using the PreparedStatemant: private static final String DEFAULT_GET_PROCS_DT_LOG = "(SELECT concat(date_format(max(dt_start),'%Y-%m-%d'),'%') FROM table)"; ...
Alex's user avatar
  • 99
1 vote
0 answers
105 views

Go Postgres prepared statements issue using up all connections

My plan was to create all the prepared statements at startup and store them in a map. Then when I need one I'll go an take it from the map and for example make an UPDATE. However after using the ...
TheQuestioner's user avatar
0 votes
1 answer
40 views

Prepared upsert giving unexpected "ambigous column" error

I have the following problem: I'm trying to created an "alias" for an UPSERT statement by creating a prepared statement. The statement operates on a table called "Sale" which has ...
randomdood1923's user avatar
1 vote
1 answer
227 views

SNOWFLAKE - How to bind variables with DDL inside a procedure?

I've used binding variables on statement like INSERT or SELECT with the '?' or ':1' placeholders, but I cannot use it with instructions like CREATE ROLE because it throws an exception. I need to bind ...
user18243519's user avatar
0 votes
0 answers
9 views

JDBC and MySql database stuck at Waiting for table metadata lock [duplicate]

I have a MySql database in combination with a project in java. For some testing I have a script which drops all tables (if exists). This runs totaly fine a bunch of times but then suddenly it stops ...
Nasten1988's user avatar
0 votes
0 answers
118 views

Athena JDBC Parameterized Query not interpreting type correctly

Getting this error - java.sql.SQLException: [Simba]AthenaJDBC Athena does not support the parameter type: java.lang.String. I am using com.simba.athena.jdbc.Driver as Athena JDBC driver. Time ...
Pale Horse's user avatar
0 votes
0 answers
135 views

inserting is very slow using statement when always encrypted is on

I have a spring boot application, with SQL server as database. One of the services that the app offer is a function who will insert data in a table (staging database). For more clarity, I will ...
M-BNCH's user avatar
  • 401
1 vote
2 answers
421 views

What is the effect disabling PreparedStatements server side in Postgres? (adding the JDBC param : prepareThreshold=0)

I'm writing a client side tool that is querying a Postgres DB using PreparedStatements. I'm running into some issues. This tool has to support a wide variety of Postgres setups. Some of these setups ...
Dev K's user avatar
  • 51
0 votes
0 answers
41 views

MySQL PreparedStatement addBatch does not run as a batch

I use a PreparedStatement and want to update a table. I write it like for (int i = 0; i < 10000; i++){ insertStatement.setString(1,"a"); insertStatement.setString(2,"b"); ...
Jacky Guo's user avatar
0 votes
2 answers
54 views

How can I replace this obviously bad string interpolation with a prepared statement?

Apart from checking that the attributeId is in a list of predefined strings – possible, but in this particular case costly – is there any way to re-write this in a less 'injectable' fashion (since the ...
Dycey's user avatar
  • 4,533
1 vote
2 answers
105 views

Fixing dynamic unknown named parameters

In this snippet below which is used only as a SELECT statement for multiple rows of data, it gives a error on $stmt->bind_param($types, ...$values);: mysqli_stmt::bind_param() does not accept ...
user avatar
0 votes
1 answer
174 views

Insert/update Hex value to DB2 Z/OS PreparedStatement

I need to insert in my database a Hex value with a PreparedStatement in Java. I can do a select with Hex function for get my value: String id = "02658947530232010038892587183C"; String ...
Maelstrom's user avatar
1 vote
1 answer
371 views

Is INSERT INTO SELECT vulnerable to SQL injections?

Say you let users insert their names (or anything into a table) and someone tries a SQL injection but you properly use prepared statements so the query is not affected. $stmt = $db->prepare("...
RDU's user avatar
  • 862
0 votes
1 answer
52 views

How to use prepared statement for separated mysql query

I am little confuse how to use prepare statement in this. i tried but failed as my query is separated. $q = "SELECT * FROM report WHERE 1"; if(isset($_GET['name']) && !empty($_GET['...
Tanvir's user avatar
  • 25

1
2 3 4 5
124