From: Austin Ziegler <halostatue@...>
Date: 2004-12-18T01:37:36+09:00
Subject: Re: String expand problem

On Sat, 18 Dec 2004 01:28:26 +0900, David A. Black <dblack@wobblini.net> wrote:
> On Sat, 18 Dec 2004, Austin Ziegler wrote:
> > On Sat, 18 Dec 2004 00:20:00 +0900, Wild Karl-Heinz <kh.wild@wicom.li> wrote:
> > Note that you probably don't want to use %s expansion for reql SQL;
> > instead use the ? substitution mechanism -- you don't have to worry
> > about escaping single quotes or other values.
> What's the ? substitution mechanism?

You write your SQL so that it reads:

   SELECT foo, bar
     FROM baz
    WHERE oingo = ?

Then, you use parameter binding (see
http://www.kitebird.com/articles/ruby-dbi.html for "Quoting,
Placeholders, and Parameter Binding"). The "?" in your SQL becomes a
parameter that you don't have to quote.

If you've ever done Oracle programming using Pro*C, this is equivalent to doing:

   SELECT foo, bar
     FROM baz
    WHERE oingo = :boingo;

It results in far more efficient SQL most of the time, because the
optimizers in quality databases (e.g., most emphatically *not* MySQL)
will detect that all queries referring the ? or :boingo can be
optimized and compiled a particular way so that only the parameters
vary and the SQL doesn't have to be recompiled every time you provide
a new value for :boingo :)

-austin
-- 
Austin Ziegler * halostatue@gmail.com
               * Alternate: austin@halostatue.ca