# Why Should I Use Prepared Statements

__*Prepared Statement*__

+ Improve the performance of queries
  + Prepare the statement once and execute it multiple times, each time using a different variable value
  + The server only parse the statement once when preparing the statement
  + Client makes statement request using the binary protocol
    + Reduced server `CPU` overhead
    + Reduces network traffic between server and client compared to resending each `SQL` statement individually
+ Make sure that the data type is correctly referenced in the `SQL` statement
+ Avoid `SQL` injections

-------------------------------------------------------------------------

When the server prepares a statement, it creates a protocol for that statement. Typically, the client passes SQL statements along with values, and these are parsed by the TiDB server from the original text strings. The protocol for the prepared statement separates the values from the rest of the statement and provides a binary mechanism to transmit values. This is more efficient than converting to and from strings.

Prepared statements also help to prevent a form of attack known as SQL injection. A malicious user can insert SQL statements into an application that expects values. Prepared statements separate SQL statements from values and prevent the interpretation of values as SQL statements.