Why prepared statements exist in SQL - Test Your Understanding

Practice - 5 Tasks

1fill in blank

easy

Complete the code to prepare a statement for selecting users by ID.

SQL

PREPARE stmt FROM '[1]';

Drag options to blanks, or click blank then click option'

ASELECT * FROM users WHERE id = ?

BINSERT INTO users VALUES (?)

CDELETE FROM users WHERE id = 1

DUPDATE users SET name = 'John'

Attempts:

3 left

💡 Hint

Common Mistakes

Using a query without placeholders.

Using a query that does not select data.

The prepared statement uses a placeholder ? for the user ID to safely insert values later.

2fill in blank

medium

Complete the code to execute the prepared statement with a value.

SQL

EXECUTE stmt USING [1];

Drag options to blanks, or click blank then click option'

A@user_id

Buser_id

C'user_id'

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using a string literal instead of a variable.

Using a variable without the @ prefix.

The variable @user_id holds the value to be used in the prepared statement.

3fill in blank

hard

Fix the error in the prepared statement to avoid SQL injection.

SQL

PREPARE stmt FROM 'SELECT * FROM users WHERE name = [1]';

Drag options to blanks, or click blank then click option'

Aname

B'John'

C?

D"John"

Attempts:

3 left

💡 Hint

Common Mistakes

Putting the value directly inside the query string.

Using quotes around the placeholder.

Using ? as a placeholder prevents SQL injection by separating code from data.

4fill in blank

hard

Fill both blanks to prepare and execute a statement safely.

SQL

PREPARE stmt FROM '[1]';
EXECUTE stmt USING [2];

Drag options to blanks, or click blank then click option'

ASELECT * FROM products WHERE price > ?

B@min_price

CSELECT * FROM products WHERE price = 10

Dmin_price

Attempts:

3 left

💡 Hint

Common Mistakes

Using a fixed value in the query instead of a placeholder.

Passing a variable without the @ sign.

The query uses a placeholder ? and the variable @min_price is passed safely to execute.

5fill in blank

hard

Fill all three blanks to prepare, set variable, and execute a statement.

SQL

SET [1] = 100;
PREPARE stmt FROM '[2]';
EXECUTE stmt USING [3];

Drag options to blanks, or click blank then click option'

A@max_stock

BSELECT * FROM inventory WHERE stock < ?

Dmax_stock

Attempts:

3 left

💡 Hint

Common Mistakes

Using variable names without @.

Not matching the variable in SET and EXECUTE.

We set the variable @max_stock, prepare a query with a placeholder, and execute using the variable.