| Home | Libraries | People | FAQ | More

## Text queries

To run a text query, use any of the following functions, passing a string-like object (convertible to `string_view`) containing valid SQL as the first parameter:

- `connection::execute` or `connection::async_execute`: these functions run the query and read the generated results into memory.
- `connection::start_execution` and `connection::async_start_execution`: these functions initiate a text query as a multi-function operation.

Almost any query that may be issued in the `mysql` command line can be executed using this method. This includes `SELECT`s, `UPDATE`s, `INSERT`s, `DELETE`s, `CREATE TABLE`s... In particular, you may start transactions issuing a `START TRANSACTION`, commit them using `COMMIT` and rolling them back using `ROLLBACK`.

#### Limitations

At the moment, there is no equivalent to `mysql_real_escape_string` to sanitize user provided input. This limits text queries to queries without parameters. Doing composition by hand can lead to SQL injection vulnerabilities. Please use prepared statements instead, which perform composition server-side in a safe way.

| Warning
SQL injection warning: if you compose queries by concatenating strings without sanitization, your code is vulnerable to SQL injection attacks. Use prepared statements when possible!

#### Running multiple queries at once

You can run several semicolon-separated queries in a single `execute()` call by enabling the `handshake_params::multi_queries` option. You can find an example here.

| Warning
SQL injection warning: do not use this feature if any of your queries contains untrusted input. You can create SQL injection vulnerabilities if you do.

#### Use cases

You should generally prefer prepared statements over text queries. Text queries can be useful for simple, non-parametrized queries:

- `"START TRANSACTION"`, `"COMMIT"` and `"ROLLBACK"` queries, for transactions.
- `"SET NAMES utf8mb4"` and similar, to set variables for encoding, time zones and similar configuration options.
- `"CREATE TABLE ..."` and similar DDL statements.

Avoid text queries involving user input.