Project: StarRocks (App Definition and Development / Database)
File: prepared_statement.md

displayed_sidebar: "English" From v3.2 onwards, StarRocks provides prepared statements for executing SQL statements multiple times with the same structure but different variables. This feature significantly improves execution efficiency and prevents SQL injection. The prepared statements basically work as follows: Preparation: Users prepare a SQL statement where variables are represented by placeholders `?`. The FE parses the SQL statement and generates an execution plan. Execution: After declaring variables, users pass these variables to the statement and execute the statement. Users can execute the same statement multiple times with different variables. Benefits Saves overhead of parsing: In real-world business scenarios, an application often executes a statement multiple times with the same structure but different variables. With prepared statements supported, StarRocks needs to parse the statement only once during the preparation phase. Subsequent executions of the same statement with different variables can directly use the pre-generated parsing result. As such, statement execution performance is significantly improved, especially for complex queries. Prevents SQL injection attacks: By separating the statement from the variables and passing user-input data as parameters rather than directly concatenating the variables into the statement, StarRocks can prevent malicious users from executing malicious SQL codes. Usages Prepared statements are effective only in the current session and cannot be used in other sessions. After the current session exits, the prepared statements created in that session are automatically dropped. The execution of a prepared statement consists of the following phases: PREPARE: Prepare the statement where variables are represented by placeholders `?`. SET: Declare variables within the statement. EXECUTE: Pass the declared variables to the statement and execute it. DROP PREPARE or DEALLOCATE PREPARE: Delete the prepared statement. Syntax: ```SQL PREPARE <stmtname> FROM <preparablestmt> ``` Parameters: `stmt_name`: the name given to the prepared statement, which is subsequently used to execute or deallocate that prepared statement. The name must be unique within a single session. `preparable_stmt`: the SQL statement to be prepared, where the placeholder for variables is a question mark (`?`). Currently, only the `SELECT` statement is

Example: Prepare a `SELECT` statement with specific values represented by placeholders `?`. ```SQL PREPARE selectbyid_stmt FROM 'SELECT * FROM users WHERE id = ?'; ``` Syntax: ```SQL SET @var_name = expr [, ...]; ``` Parameters: `var_name`: the name of a user-defined variable. `expr`: a user-defined variable. Example: Declare variables. ```SQL SET @id1 = 1, @id2 = 2; ``` For more information, see . Syntax: ```SQL EXECUTE <stmtname> [USING @varname [, @var_name] ...] ``` Parameters: `var_name`: the name of a variable declared in the `SET` statement. `stmt_name`: the name of the prepared statement. Example: Pass variables to a `SELECT` statement and execute that statement. ```SQL EXECUTE selectbyid_stmt USING @id1; ``` Syntax: ```SQL {DEALLOCATE | DROP} PREPARE <stmt_name> ``` Parameters: `stmt_name`: The name of the prepared statement. Example: Delete a prepared statement. ```SQL DROP PREPARE selectbyid_stmt; ``` The following example demonstrates how to use prepared statements to insert, delete, update, and query data from a StarRocks table: Assuming the following database named `demo` and table named `users` are already created: ```SQL CREATE DATABASE IF NOT EXISTS demo; USE demo; CREATE TABLE users ( id BIGINT NOT NULL, country STRING, city STRING, revenue BIGINT ) PRIMARY KEY (id) DISTRIBUTED BY HASH(id); ``` Prepare statements for execution. ```SQL PREPARE selectallstmt FROM 'SELECT * FROM users'; PREPARE selectbyid_stmt FROM 'SELECT * FROM users WHERE id = ?'; ``` Declare variables in these statements. ```SQL SET @id1 = 1, @id2 = 2; ``` Use the declared variables to execute the statements. ```SQL -- Query all data from the table. EXECUTE selectallstmt; -- Query data with ID 1 or 2 separately. EXECUTE selectbyid_stmt USING @id1; EXECUTE selectbyid_stmt USING @id2; ``` The following example demonstrates how a Java application can use a JDBC driver to insert, delete, update, and query data from a StarRocks table: When specifying StarRocks' connection URL in JDBC, you need to enable server-side prepared statements: ```Plaintext jdbc:mysql://<feip>:<fequery_port>/useServerPrepStmts=true ``` The StarRocks GitHub project provides a that explains how to insert, delete, update, and query data from a StarRocks table through a JDBC driver.