Ein Prepared Statement ausführen (binden, nicht konkatenieren) snippet

-- the template: $1 is a bind slot, not text — nothing to escape into
PREPARE get_user AS
  SELECT id, name, email FROM users WHERE id = $1;

EXECUTE get_user(42);   -- the data arrives as a VALUE, never as query text

DEALLOCATE get_user;    -- or it lives until the session ends

-- EXECUTE get_user('42 OR 1=1');  -- ERROR: invalid input syntax —
-- a payload that reaches a bind slot stays data and is rejected

const { Pool } = require('pg');
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

// one call, two payloads: the template rides one wire message, values another
const { rows } = await pool.query(
  'SELECT id, name FROM users WHERE id = $1',
  [userId],
);

// NEVER: `SELECT ... WHERE id = ${userId}`  — the value became query text

import type { Pool } from 'pg';

async function query<T>(
  pool: Pool,
  sql: string,
  params: unknown[] = [],
): Promise<T[]> {
  const result = await pool.query(sql, params);
  return result.rows as T[];
}

interface UserRow { id: number; name: string }

const users = await query<UserRow>(
  pool,
  'SELECT id, name FROM users WHERE id = $1',
  [userId],
);

import (
	"context"
	"database/sql"
)

func userName(ctx context.Context, db *sql.DB, id int64) (string, error) {
	var name string
	// database/sql prepares transparently — you never see it happen
	err := db.QueryRowContext(ctx,
		"SELECT name FROM users WHERE id = ?", id).Scan(&name)
	return name, err
}

// hot loop? prepare ONCE, execute N — one compiled plan:
func userNames(ctx context.Context, db *sql.DB, ids []int64) ([]string, error) {
	stmt, err := db.PrepareContext(ctx, "SELECT name FROM users WHERE id = ?")
	if err != nil {
		return nil, err
	}
	defer stmt.Close() // leaked stmts pin their connection until it dies

	names := make([]string, 0, len(ids))
	for _, id := range ids {
		var name string
		if err := stmt.QueryRowContext(ctx, id).Scan(&name); err != nil {
			return nil, err
		}
		names = append(names, name)
	}
	return names, nil
}

use sqlx::PgPool;

async fn user_name(pool: &PgPool, id: i64) -> Result<String, sqlx::Error> {
    // COMPILE-TIME checked: columns, types, and the bind are verified
    // against the real schema before the binary exists
    let user = sqlx::query!("SELECT name FROM users WHERE id = $1", id)
        .fetch_one(pool)
        .await?;
    Ok(user.name)
}

// no live DB at build time? SQLX_OFFLINE=true + cargo sqlx prepare's
// checked-in .sqlx cache. Dynamic SQL (identifiers can't be a $bind)?
// build it with sqlx::query(...) — never format!() on the SQL string.

$pdo = new PDO($dsn, $user, $pass, [
    PDO::ATTR_ERRMODE          => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_EMULATE_PREPARES => false, // REAL prepares on the server
]);

$stmt = $pdo->prepare('SELECT id, name FROM users WHERE email = ?');
$stmt->execute([$email]); // ? is positional: values land in marker order

foreach ($stmt as $row) {
    // $row['name'] ...
}

// the vulnerability this replaces:
// $pdo->query("SELECT ... WHERE email = '$email'"); // string-built text

import psycopg

with psycopg.connect(ENV['DATABASE_URL']) as conn:
    with conn.cursor() as cur:
        # %s is the DBAPI bind marker, NOT python % formatting:
        cur.execute(
            'SELECT id, name FROM users WHERE id = %s',
            (user_id,),  # a one-element tuple — the comma IS the tuple
        )
        row = cur.fetchone()

# identifiers (table/column names) can never be a %s — compose them safely:
from psycopg import sql
query = sql.SQL('SELECT id FROM {} WHERE id = %s').format(
    sql.Identifier('users'))

using var conn = new SqlConnection(connectionString);
conn.Open();

using var cmd = new SqlCommand(
    "SELECT name FROM users WHERE id = @id", conn); // @name markers
cmd.Parameters.Add("@id", SqlDbType.BigInt).Value = userId; // explicit type

using var reader = cmd.ExecuteReader();
while (reader.Read())
{
    var name = reader.GetString("name");
}

// the vulnerability this replaces:
// new SqlCommand($"SELECT name FROM users WHERE id = {userId}", conn)

try (Connection conn = dataSource.getConnection();
     PreparedStatement ps = conn.prepareStatement(
         "SELECT name FROM users WHERE id = ?")) { // ? = positional bind slot

    ps.setLong(1, userId); // 1-based index, typed setter
    try (ResultSet rs = ps.executeQuery()) {
        while (rs.next()) {
            String name = rs.getString("name");
        }
    }
}

// the anti-pattern this replaces — Statement + concatenation:
// Statement st = conn.createStatement();
// st.executeQuery("SELECT name FROM users WHERE id = " + userId);

dataSource.connection.use { conn ->
    conn.prepareStatement("SELECT name FROM users WHERE id = ?").use { ps ->
        ps.setLong(1, userId) // same JDBC as Java, 1-based ?
        ps.executeQuery().use { rs ->
            if (rs.next()) rs.getString("name") else null
        }
    }
}

// Spring's named form — :name markers read from a Map:
// named.queryForObject(
//     "SELECT name FROM users WHERE id = :id",
//     mapOf("id" to userId), String::class.java)

require 'sequel'

# Sequel: the ?-array IS the bind — placeholders and values never meet as text:
user = DB['SELECT id, name FROM users WHERE id = ?', user_id].first

# plain pg gem — params ride exec_params, NEVER exec (exec is raw text):
# conn.exec_params('SELECT id, name FROM users WHERE id = $1', [user_id])

# ActiveRecord: hash conditions are binds by construction:
# User.where(email: email).pick(:id)