CODEWITHSUNDEEP
sqldatabaseprepared-statement
user2472968
user2472968

Reputation: 395

Sql question marks in insert statement

This may seem a very rudimentary question but I am not clear about it. In my code I have a query 

    "insert into CONTACTS (EMAIL, FIRSTNAME, LASTNAME, TELEPHONE) values (?, ?, ?, ?)"

What is the '?' in the values, is it to fetch the real time values?

Upvotes: 11

Views: 18669

Answers (2)

Gaurav Pant
Gaurav Pant

Reputation: 4199

In programming context where you need to insert multiple set of data into same table-

If you need to insert multiple set of values into database table then there is no need to prepare statement every-time to insert the new value. You will just prepare the insert statement once and will use this prepared with different set of values.These '?' acts as placeholder for different set of values which will be populated later during the time of execution. It results better performance.

It you are using this with database prompt then it is basically used to let user give input at command prompt. It will give prompt to user to insert data.

Please go through " How can I prevent SQL injection in PHP? " to know how we can avoid sql injunction by using '?'.

Upvotes: 3

SheetJS
SheetJS

Reputation: 22905

This is coming from some prepared statement. Those question marks will be populated with values later on, before the query is executed.

Upvotes: 13

Related Questions