▁the ▁best ▁plan ▁may ▁depend ▁on ▁the ▁specific ▁values ▁of ▁the ▁parameters , ▁and ▁the ▁best ▁plan ▁may ▁change ▁as ▁tables ▁and ▁indexes ▁change ▁over ▁time . ▁▁ ▁P rep ared ▁statements ▁are ▁res il ient ▁against ▁SQL ▁injection ▁because ▁values ▁which ▁are ▁transm itted ▁later ▁using ▁a ▁different ▁protocol ▁are ▁not ▁compiled ▁like ▁the ▁statement ▁template . ▁If ▁the ▁statement ▁template ▁is ▁not ▁derived ▁from ▁external ▁input , ▁SQL ▁injection ▁cannot ▁occur . ▁ ▁On ▁the ▁other ▁hand , ▁if ▁a ▁query ▁is ▁executed ▁only ▁once , ▁server - side ▁prepared ▁statements ▁can ▁be ▁slower ▁because ▁of ▁the ▁additional ▁round - tri p ▁to ▁the ▁server . ▁Im plementation ▁limitations ▁may ▁also ▁lead ▁to ▁performance ▁pen alt ies ; ▁for ▁example , ▁some ▁versions ▁of ▁MySQL ▁did ▁not ▁cache ▁results ▁of ▁prepared ▁queries . ▁ ▁A ▁stored ▁procedure , ▁which ▁is ▁also ▁pre comp iled ▁and ▁stored ▁on ▁the ▁server ▁for ▁later ▁execution , ▁has ▁similar ▁advantages . ▁Un like ▁a ▁stored ▁procedure , ▁a ▁prepared ▁statement ▁is ▁not ▁normally ▁written ▁in ▁a ▁proced ural ▁language ▁and ▁cannot ▁use ▁or ▁modify ▁variables ▁or ▁use ▁control ▁flow ▁structures , ▁re lying ▁instead ▁on ▁the ▁declar ative ▁database ▁query ▁language . ▁Due ▁to ▁their ▁simplicity ▁and ▁client - side ▁em ulation , ▁prepared ▁statements ▁are ▁more ▁port able ▁across ▁vend ors . ▁ ▁Software ▁support ▁ ▁Major ▁DB MS s , ▁including ▁MySQL , ▁Oracle , ▁DB 2 , ▁Microsoft ▁SQL ▁Server ▁and ▁Post gre SQL ▁widely ▁support ▁prepared ▁statements . ▁P rep ared