A new learning at work.

How MySQL handles parameters in query

With interpolateParams=false, the driver has to do three roundtrips to the database:

  • prepare a statement,
  • execute it with given parameters and
  • close the statement again

If interpolateParams is true, placeholders (?) in calls to db.Query() and db.Exec() are interpolated into a single query string with given parameters in the driver library. This reduces the number of roundtrips.

SQL Injection risk

https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string/12118602#12118602