Received: from localhost (postgresql.org [64.49.215.8])
	by postgresql.org (Postfix) with ESMTP
	id 86A7747677B; Fri, 24 Jan 2003 15:38:55 -0500 (EST)
Received: from varsoon.wireboard.com (www.wireboard.com [216.151.155.101])
	by postgresql.org (Postfix) with ESMTP
	id 389EC477166; Fri, 24 Jan 2003 15:02:08 -0500 (EST)
Received: from doug by varsoon.wireboard.com with local (Exim 3.35 #1)
	id 18cA12-00082Q-00; Fri, 24 Jan 2003 15:01:28 -0500
To: gearond@cvc.net
Cc: "Nigel J. Andrews" <nandrews@investsystems.co.uk>,
	Greg Stark <gsstark@mit.edu>, pgsql-general@postgresql.org,
	pgsql-interfaces@postgresql.org
Subject: Re: More PHP DB abstraction layer stuff
References: <2ZNYVFD2X72ONE0091WQPZXGJEC7WR.3e319071@cal-lab>
From: Doug McNaught <doug@mcnaught.org>
Date: 24 Jan 2003 15:01:27 -0500
In-Reply-To: Dennis Gearon's message of "Fri, 24 Jan 2003 11:13:53 -0800"
Message-ID: <m3y95ami5k.fsf@varsoon.wireboard.com>
Lines: 20
User-Agent: Gnus/5.0806 (Gnus v5.8.6) Emacs/20.7
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-Virus-Scanned: by AMaViS new-20020517
X-Archive-Number: 200301/1044
X-Sequence-Number: 36165

Dennis Gearon <gearond@cvc.net> writes:

> could you elaborate on:
> 
> 	Place holders ( those are in prepared queries, yes?)
> 	out of band?

I think by "out of band" Greg just means substituting values into a
prepared query rather than glomming everything into an SQL string by
yourself.  For example, in Perl DBI you'd do something like:

$stmt = $dbh->prepare("select * from mytable where first_name = ?");
$ret_val = $sth->execute("Fred");   # might come from a web form instead
@row = $sth->fetchrow_array();

The database driver is responsible for turning the '?' in the query
into a properly-quoted and escaped value, or otherwise supplying it to
the database.  The '?' is a placeholder.

-Doug