To: Greg Stark <gsstark@mit.edu>
Cc: gearond@cvc.net, "Nigel J. Andrews" <nandrews@investsystems.co.uk>,
	pgsql-general@postgresql.org, pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
References: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab>
	<m3y95ami5k.fsf@varsoon.wireboard.com>
	<87r8b2nvwr.fsf@stark.dyndns.tv>
From: Doug McNaught <doug@mcnaught.org>
Date: 24 Jan 2003 15:24:56 -0500
In-Reply-To: Greg Stark's message of "24 Jan 2003 15:19:00 -0500"
Message-ID: <m3u1fymh2f.fsf@varsoon.wireboard.com>
Lines: 27
User-Agent: Gnus/5.0806 (Gnus v5.8.6) Emacs/20.7
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii

Greg Stark <gsstark@mit.edu> writes:

> Doug McNaught <doug@mcnaught.org> writes:
> 
> > $stmt = $dbh->prepare("select * from mytable where first_name = ?");
> > $ret_val = $sth->execute("Fred");   # might come from a web form instead
> > @row = $sth->fetchrow_array();
> > 
> > The database driver is responsible for turning the '?' in the query
> > into a properly-quoted and escaped value, or otherwise supplying it to
> > the database.  The '?' is a placeholder.
> 
> Except that that's not what the driver does, at least not for databases that
> are capable of doing better. It sends the placeholders to the database as they
> are. (Or in a different syntax like :1 :2 :3 for Oracle for example.) 

Right, but currently for PG (this being a PG list :) it just does the
quoting/escaping and builds the query itself.  It's still safer than
doing it by hand, as long as the database driver is trustworthy and
knows the databases escaping conventions.

I think there has been discussion about extending the protocol to
allow Oracle-style prepared statement execution, but right now it
isn't supported.  Prepared queries only went in in 7.3, after all...

-Doug