---
id: sql-prepared-statements
title: "SQL Prepared Statements"
category: "Database"
status: "draft"
verification_status: "conceptual"
canonical_id: ""
aliases: ["Prepared Statements", "SQL 준비된 문"]
duplicate_of: ""
source_trust_level: "B"
confidence_score: 0.87
created_at: 2026-07-04
updated_at: 2026-07-04
review_reason: ""
merge_history: []
tags: ["sql", "database", "w3schools", "security", "prepared-statements", "php", "mysql"]
raw_sources: ["https://www.w3schools.com/sql/sql_prepared_statements.asp"]
applied_in: []
github_commit: ""
---

# [[SQL Prepared Statements]]

## 🎯 한 줄 통찰 (One-line insight)
Prepared statements separate a query's structure (compiled once, sent as a placeholder template) from its data (bound and sent later, possibly many times) — gaining security, performance, and bandwidth savings in one mechanism. [S1]

## 🧠 핵심 개념 (Core concepts)
- **Prepared statement** — separates the query structure (the SQL) from the actual data (user input). [S1]
- **Two-phase lifecycle** — Prepare (send a placeholder template like `INSERT INTO MyGuests VALUES(?, ?, ?)`, parsed/compiled/optimized without executing) then Execute (bind values, run — repeatable with different values). [S1]
- **Four advantages** — reduced parsing time (prepared once, executed many times), minimized bandwidth (only parameters sent per call, not the whole query), security (bound values need not be escaped and can't alter the SQL structure), cleaner code (data separated from SQL). [S1]
- **Type-tagged binding (MySQL)** — `bind_param("sss", ...)` declares each parameter's type (`i`=integer, `d`=double, `s`=string, `b`=binary), which minimizes injection risk by telling MySQL exactly what type to expect. [S1]

## 🧩 추출된 패턴 (Extracted patterns)
- **Prepare-once, execute-many** — a single prepared statement can be executed repeatedly with different bound values (three inserts in the example, same statement object). [S1]
- **Sanitize inputs from external sources anyway** — the source notes that even with prepared statements, data from user input should still be sanitized/validated — prepared statements prevent structural injection, not all bad input. [S1]

## 📖 세부 내용 (Details)
- MySQL prepared statement (PHP), templated insert with three placeholders: [S1]
```php
$sql = "INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)";
if($stmt = $conn->prepare($sql)) {
    $stmt->bind_param("sss", $firstname, $lastname, $email);
    $firstname = "John"; $lastname = "Doe"; $email = "john@example.com";
    $stmt->execute();
    // ... repeat with different values, same $stmt
}
```
- Type characters for `bind_param`: `i` integer, `d` double, `s` string, `b` binary. [S1]

## ⚖️ 모순 및 업데이트 (Contradictions & updates)
소스에서 모순되는 정보는 발견되지 않음.

## 🛠️ 적용 사례 (Applied in summary)
현재 발견된 실제 적용 사례가 없습니다 — SQL Parameters(단순 바인딩)와 함께 SQL Injection 방어의 양대 축을 이룬다. [S1]

## 💻 코드 패턴 (Code patterns)
Prepared statement, prepare once execute many (PHP/MySQL):
```php
$sql = "INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)";
$stmt = $conn->prepare($sql);
$stmt->bind_param("sss", $firstname, $lastname, $email);
$stmt->execute();
```

## ✅ 검증 상태 및 신뢰도
- **상태:** draft
- **검증 단계:** conceptual
- **출처 신뢰도:** B (W3Schools — widely used educational reference, not a primary standards body)
- **신뢰 점수:** 0.87
- **중복 검사 결과:** 신규 생성 (New discovery)

## 🔗 지식 그래프 (Knowledge Graph)
- **상위/루트:** [[SQL Tutorial]]
- **관련 개념:** [[SQL Injection]], [[SQL Parameters]], [[SQL Stored Procedures]]
- **참조 맥락:** SQL Injection 방어와 반복 실행 성능 최적화를 동시에 달성하는 표준 기법.

## 📚 출처 (Sources)
- [S1] W3Schools — SQL Prepared Statements — https://www.w3schools.com/sql/sql_prepared_statements.asp

## 📝 변경 이력 (Change history)
- 2026-07-04: Initial draft synthesized from the W3Schools "SQL Prepared Statements" page (Astra wiki-curation, P-Reinforce v3.1 format).