Home/ Questions/Q 39691
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-10T14:54:18+00:00

.NET, Java and other high level database API’s in various language often provide techniques

  • 0

.NET, Java and other high level database API’s in various language often provide techniques known as prepared statements and parameter binding as opposed to sending plain text commands to the Database server. What I would like to know is what happens when you execute a statement like this:

SqlCommand cmd = new SqlCommand('GetMemberByID'); cmd.CommandType = CommandType.StoredProcedure; SqlParameter param = new SqlParameter('@ID', memberID); para.DbType = DbType.Integer; cmd.Parameters.Add(param);

I know this is a best practice. SQL injection attacks are minimized this way. But what exactly happens under the hood when you execute these statements? Is the end result still a SQL safe string? If not, what is the end result? And is this enough to prevent SQL injection attacks?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. The MySQL manual page on prepared statements provides lots of information (which should apply to any other RDBMS).

    Basically, your statement is parsed and processed ahead of time, and the parameters are sent separately instead of being handled along with the SQL code. This eliminates SQL-injection attacks because the SQL is parsed before the parameters are even set.

    • 0