准备语句与直接查询

Question

The common consensus appears to be that directly queried statements don't allow parameters, and that prepared statements do.

However in Go's database/sql package, you are allowed to use the ODBC parameters and send parameters to such things as db.QueryRow() and db.Query(). So it appears that they are functionally equivalent.

That being said, what is the point then, of first creating a statement, and then executing it? Let's say statements compile against the database first -- doesn't that increase load and thereby reduce performance since you're adding an extra trip? And since you can get parameters from Query/QueryRow, wouldn't that make statements a bad thing?

Answer 1

Keep in mind that the database/sql package is a package designed to cover the functionality of all theoretically possible SQL database systems without getting in the way of platform-specifics.

SQL driver instances are injected at runtime through sql.Register. These drivers do not necessarily build on ODBC, it could be something else.

Some SQL-databases support escaping query parameters, some don't – some support "compiling" of prepared statements, others don't.

By making it a 2-step process, the driver can decide where and how to escape query parameters and how they will be inserted into the query.

you are allowed to use the ODBC parameters and send parameters to such things as db.QueryRow() and db.Query()

The methods have this signature for convenience only, in the background the driver still escapes and queries separately. You can see this happen here and here, respectively.