使用准备好的mysql语句进行一个查询是否值得？

Question

If I have a simple prepared query like this:

$stmt = $conn->prepare("INSERT INTO MyGuests (firstname, lastname, email) VALUES (?, ?, ?)");
$stmt->bind_param("sss", $firstname, $lastname, $email);

// set parameters and execute
$firstname = "John";
$lastname = "Doe";
$email = "john@example.com";
$stmt->execute();

And I only execute the query once during the lifetime of the page.

Is it worth it using a prepared mysql statements for queries like that?

Answer 1

What you want most of all here is the security of parameterised queries. The API to do parameterised queries happens to be the same as the one for prepared statements. Or in other words, the API that enables the separation of the query structure from the submission of the values kills two birds with one stone:

1. Safe transfer of arbitrary values to the database engine.
2. Reusability of already parsed queries.

It's worth it if you're just using one of them, you don't need to use both aspects at the same time to justify the use of the prepare API.

The alternative of manually escaping values is always more error prone and verbose.