I am curious what the difference is between queries and prepared statements in npm mssql.
They look the same to me, as most importantly they both sanitize the input.
The query looks simpler to write, but what do I not know? Why use the one over the other?
Query
const sql = require('mssql')
(async function () {
try {
let pool = await sql.connect(config)
let result = await pool.request()
.input('input_parameter', sql.Int, value)
.query('select * from mytable where id = @input_parameter')
console.dir(result)
} catch (err) {
// ... error checks
}
})()
Prepared statement
const ps = new sql.PreparedStatement(/* [pool] */)
ps.input('param', sql.Int)
ps.prepare('select @param as value', err => {
// ... error checks
ps.execute({param: 12345}, (err, result) => {
// ... error checks
// release the connection after queries are executed
ps.unprepare(err => {
// ... error checks
})
})
})