real_escape_string vs. prepared statements

问题:

is there any reason to use one over the other in terms of speed and safety? Thanks!

回答1:

Speed:

• When you use bind parameters you can reuse the same query and query plan, just changing the parameters. When you build a query from strings the database has to reparse the statement.
• With bind parameters the SQL parser also has less work to do. The parameters aren't escaped so the parsing is simpler.

Safety:

• In my opinion, it is much easier to remember to use parameters than to remember to escape strings.