When parameterization fails: SQL injection in Nim using parameterized queries (opens in new tab)

The origin of the whole idea, I believe, was to have _prepared_ statements, ie not to have to pay the price of parsing the query and determining the query plan. Yes I know all this sounds like "premature optimization" in this day and age when we are used to casual conversation in natural language with the computer and forgot how hard of a task it is already just to parse a formal language like sql, compared to finding the customer which id is 123 in a btree.

Yes. And that is what a client should 100% do from the security standpoint. But since you mention caching - from the perf standpoint, it could sometimes be beneficial for the query planner to know the values before coming up with the query plan. Sometimes I have done little optimizations by replacing prepared statement placeholders with baked-in numbers or known enum values.