Skip to main content

Prepared statements

Prepared statements bind parameters safely so user input is not concatenated into raw SQL.

Why use them​

  • Reduce SQL injection risk.
  • Let the database plan reuse for repeated queries.

In Groove Builder​

  1. Write SQL with placeholders as shown in the query editor for your plugin (for example $1 / mustache-bound params depending on the database).
  2. Map each parameter to a widget or JS value.
  3. Keep Prepared statement enabled in query settings unless you have a documented reason to disable it.

Dynamic table/column identifiers usually cannot be prepared — validate those in JS before building the statement.