Skip to content

Parameterised queries

1 message · Alex Mandel

#
On 02/13/2015 06:36 PM, Paul Gilbert wrote:
I'm not sure all DBs allow this format (seem at least Postgres, MySQL
and SQlite do). This looks like kinda like a DB native way of doing
prepared/parametrized insert. I suspect this would be similar in speed.
Note at least in python using prepared statements is also a security
feature, as it sanitizes the inputs so you can't sneak in ; where it
doesn't belong. Not sure if that's part of this DBI plan. Having to
write a SQL string like the above in R would be a real pain. Being able
to just pass a data.frame or list of lists to a single SQL with
placeholders is much simpler.
No, I don't think so, the way you would do this would be to have blanks
in your data.frame for the values you wanted to not fill in. Others wise
you would have a ragged array which is odd to handle in general.
But you can't do that in a regular insert statement anyways. Number of
columns listed is the number of values you have to pass for it to work.