# Prepared Statement

__*Prepared Statement*__
__*PREPARE*__
__*User defined variable*__

+ Precompiled statements restrict the flexibility of SQL statements
+ It saves SQL Parse time and increases efficiency
+ This is one of the options that avoids SQL injection and only accepts the specified value
+ Use prepared statement in mysql-client:

```
tidb> ~!@PREPARE@!~ check_query FROM
    -> 'SELECT name, gravity, global_magnetic_field
    '>  FROM universe.planets
    '>  WHERE global_magnetic_field = 1
    '>  AND (gravity ~!@BETWEEN ? AND ?@!~)';
tidb> set @low=5;
tidb> set @high=10;

tidb> ~!@EXECUTE@!~ check_query USING @low, @high;
+--------+---------+-----------------------+
| name   | gravity | global_magnetic_field |
+--------+---------+-----------------------+
| Earth  |     9.8 |                     1 |
| Saturn |     9.0 |                     1 |
| Uranus |     8.7 |                     1 |
+--------+---------+-----------------------+
3 rows in set (0.00 sec)
```

------------------------------------------------------------
We will talk more about prepared statements in developer course - Using Database Connectors.