How can I get a String with a parametrized SQL query, once parameters inserted ?
I think you're assuming that the parameter values will be injected into the SQL and that what ends up being sent to the server is a single string. There's no reason why that needs to be the case - although it could be in some cases.
Generally it would make more sense to send the parameters to the database alongside the SQL but distinct from it. That way there's less work for the SQL engine to do (e.g. parsing numeric values which have been convered into strings), less work for the client to do, less risk of SQL injection attacks due to a failure to escape everything perfectly.
Collected from the Internet
Please contact [email protected] to delete if infringement.
Comments