prepare method

PreparedStatement prepare(
  1. String sql
)

Parse sql once and return a reusable PreparedStatement. Bind parameters in the SQL (?, ?N, :name, @name, $name) are substituted at .execute(...) time, so the statement can be run many times with different bindings without re-parsing.

This is the recommended way to embed user-supplied values in queries — it eliminates the need for ad-hoc string concatenation and therefore the entire SQL-injection attack surface.

Implementation

PreparedStatement prepare(String sql) {
  final p = Parser.fromString(sql);
  final stmt = p.parseStatement();
  return PreparedStatement.internal(
    db: this,
    stmt: stmt,
    sql: sql,
    positionalCount: p.paramCount,
    namedParams: Set.unmodifiable(p.namedParams),
  );
}