# Why Should I Use Prepared Statements

__*Prepared Statement*__

+ Improve the performance of queries
  + Prepare the statement once and execute it multiple times, each time using a different variable value
  + The server only parse the command once when preparing the statement
  + Client makes statement request using the binary protocol
    + Reduced server CPU overhead
    + Reduces network traffic between server and client compared to resending each SQL statement individually
+ Make sure that the data type is correctly referenced in the SQL command
+ Avoid SQL injections

-------------------------------------------------------------------------

When the server prepares a statement, it creates a protocol for that statement. Typically, the client passes SQL statements along with values, and these are parsed by the TiDB server from the original text strings. The protocol for the prepared statement separates the values from the rest of the statement and provides a binary mechanism to transmit values. This is more efficient than converting to and from strings.

Prepared statements also help to prevent a form of attack known as SQL injection. A malicious user can insert SQL commands into an application that expects values. Prepared statements separate SQL commands from values and prevent the interpretation of values as SQL statements.