类:StatementSync
¥Class: StatementSync
此类表示单个 准备好的语句。此类无法通过其构造函数实例化。相反,实例是通过 database.prepare()
方法创建的。此类公开的所有 API 均同步执行。
¥This class represents a single prepared statement. This class cannot be
instantiated via its constructor. Instead, instances are created via the
database.prepare()
method. All APIs exposed by this class execute
synchronously.
准备好的语句是用于创建它的 SQL 的有效二进制表示。准备好的语句是可参数化的,可以使用不同的绑定值多次调用。参数还提供针对 SQL 注入 攻击的保护。出于这些原因,在处理用户输入时,准备好的语句比手工制作的 SQL 字符串更受青睐。
¥A prepared statement is an efficient binary representation of the SQL used to create it. Prepared statements are parameterizable, and can be invoked multiple times with different bound values. Parameters also offer protection against SQL injection attacks. For these reasons, prepared statements are preferred over hand-crafted SQL strings when handling user input.