SQL Antipatterns, Volume 1

Mini-Antipattern: Query Parameters inside Quotes

“Why does my query fail to find any data when I use a parameterized query? When I interpolate a variable into the SQL string, it works."

A common mistake is to put the query parameter placeholder inside quotes (the following example uses ? as the placeholder, the default for MySQL):

​SELECT​ * ​FROM​ Bugs ​WHERE​ bug_id = ​'?'​

This treats the question mark symbol as a string literal, not a parameter placeholder. The bug_id, being an integer, is compared to the numeric value of the string literal, which is zero. In this table, the bug_id values start at 1, so a value of zero will not match any row.

If you think about it, it must do this, because otherwise there would ...