Interview question
What are prepared statements and why are they important? Prepared statements क्या हैं और क्यों ज़रूरी हैं?
Answer
Prepared statements separate SQL logic from data, so user input is never treated as executable SQL. This is the primary defense against SQL injection.
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $userInput]);
$user = $stmt->fetch();Workflow:
1. Prepare SQL template with placeholders → 2. Database compiles the query plan → 3. Bind actual values → 4. Execute with values treated strictly as data, never code
1. Prepare SQL template with placeholders → 2. Database compiles the query plan → 3. Bind actual values → 4. Execute with values treated strictly as data, never code
Without prepared statements, concatenating user input directly into SQL strings allows attackers to inject malicious SQL.
Prepared statements SQL logic को data से अलग रखते हैं, इसलिए user input कभी executable SQL नहीं बनता। यह SQL injection से बचने का मुख्य तरीका है।
$stmt = $pdo->prepare('SELECT * FROM users WHERE email = :email');
$stmt->execute(['email' => $userInput]);
$user = $stmt->fetch();Workflow:
1. SQL template prepare करें → 2. Database query plan compile करता है → 3. असली values bind करें → 4. Execute - values सिर्फ data होते हैं, code नहीं
1. SQL template prepare करें → 2. Database query plan compile करता है → 3. असली values bind करें → 4. Execute - values सिर्फ data होते हैं, code नहीं
Was this answer clear?