Placeholders and Bind Values

Some drivers support placeholders and bind values. Placeholders, also
called parameter markers, are used to indicate values in a database
statement that will be supplied later, before the prepared statement is
executed. For example, an application might use the following to
insert a row of data into the SALES table:

INSERT INTO sales (product_code, qty, price) VALUES (?, ?, ?)

or the following, to select the description for a product:

SELECT description FROM products WHERE product_code = ?

The “?” characters are the placeholders. The association of actual
values with placeholders is known as binding, and the values are
referred to as bind values. Note that the “?” is not enclosed in
quotation marks, even when the placeholder represents a string.

I haven’t used PG in a long time, but normally you “prepare” the query; the standard interface is usually something like this:

db = databaseConnection() ;
sth = prepareStatement(“INSERT INTO table (xval, yval, strval, dataval) VALUES (?, ?, ?, ?)”) ;
db->execute(sth, arg1, arg2, arg3, arg4) ;

It’s always preferable to try and avoid passing data to the SQL parser even if for no reason other than it’s more efficient to pass it a placeholder/token instead of your data in terms of time it takes to process.