Question

I’ve been reading a lot about prepared statements and in everything I’ve read, no one talks about the downsides of using them. Therefore, I’m wondering if there are any “there be dragons” spots that people tend to overlook?

Answer 1

Prepared statement is just a parsed and precompiled SQL statement which just waits for the bound variables to be provided to be executed.

Any executed statement becomes prepared sooner or later (it need to be parsed, optimized, compiled and then executed).

A prepared statement just reuses the results of parsing, optimization and compilation.

Usually database systems use some kind of optimization to save some time on query preparation even if you don’t use prepared queries yourself.

Oracle, for instance, when parsing a query first checks the library cache, and if the same statement had already been parsed, it uses the cached execution plan instead.