Assemble parameterized statements

If some column or expression value is provided when the statement actually executes, you assemble the parameterized statement as the statement string. Specify input parameters in the statement text representation of an SQL statement.

You indicate the presence of an input parameter with a question mark (?) anywhere within a statement where an expression is valid. You cannot list a program-variable name in the text of an SQL statement because the database server knows nothing about variables declared in the DataBlade® API module. You cannot use an input parameter to represent an identifier such as a database name, a table name, or a column name.

For example, the following code fragment shows an INSERT statement that uses input parameters as placeholders for two column values in the customer table.
Figure 1. Preparing a statement that contains input parameters
insrt_stdesc = mi_prepare(conn, 
   "INSERT INTO customer (customer_num, company) \
   VALUES (?,?);", NULL

In the preceding table, the first input parameter is defined for the value of the customer_num column and the second for the value of the company column.

Before the prepared statement executes, your DataBlade® API module must assign a value to the input parameter. You pass these input-parameter values as arguments to the mi_exec_prepared_statement() or mi_open_prepared_statement() function.