# Prepared Statement

__*Prepared Statement*__
__*PREPARE*__
__*用户变量*__

+ 预编译的语句控制了 SQL 语句的灵活性
+ 它可以节省 SQL Parse 的时间, 提高效率
+ 这是避免 SQL 注入,并只接受指定值的选项之一
+ 在 mysql-client 里使用预编译语句:

```
tidb> ~!@PREPARE@!~ check_query FROM
    -> 'SELECT name, gravity, global_magnetic_field
    '>  FROM universe.planets
    '>  WHERE global_magnetic_field = 1
    '>  AND (gravity ~!@BETWEEN ? AND ?@!~)';
tidb> set @low=5;
tidb> set @high=10;

tidb> ~!@EXECUTE@!~ check_query USING @low, @high;
+--------+---------+-----------------------+
| name   | gravity | global_magnetic_field |
+--------+---------+-----------------------+
| Earth  |     9.8 |                     1 |
| Saturn |     9.0 |                     1 |
| Uranus |     8.7 |                     1 |
+--------+---------+-----------------------+
3 rows in set (0.00 sec)
```

------------------------------------------------
[no notes]