Bind values to a parameterized/prepared statement
Description
For parametrized or prepared statements,
the dbSendQuery(), dbSendQueryArrow(), and dbSendStatement() functions
can be called with statements that contain placeholders for values.
The dbBind() and dbBindArrow() functions bind these placeholders
to actual values,
and are intended to be called on the result set
before calling dbFetch() or dbFetchArrow().
The values are passed to dbBind() as lists or data frames,
and to dbBindArrow() as a stream
created by nanoarrow::as_nanoarrow_array_stream().
![[Experimental]](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB3aWR0aD0iMTM4IiBoZWlnaHQ9IjIwIiByb2xlPSJpbWciIGFyaWEtbGFiZWw9ImxpZmVjeWNsZTogZXhwZXJpbWVudGFsIj4KICAgIDx0aXRsZT5saWZlY3ljbGU6IGV4cGVyaW1lbnRhbDwvdGl0bGU+CiAgICA8bGluZWFyR3JhZGllbnQgaWQ9InMiIHgyPSIwIiB5Mj0iMTAwJSI+CiAgICAgICAgPHN0b3Agb2Zmc2V0PSIwIiBzdG9wLWNvbG9yPSIjYmJiIiBzdG9wLW9wYWNpdHk9Ii4xIiAvPgogICAgICAgIDxzdG9wIG9mZnNldD0iMSIgc3RvcC1vcGFjaXR5PSIuMSIgLz4KICAgIDwvbGluZWFyR3JhZGllbnQ+CiAgICA8Y2xpcFBhdGggaWQ9InIiPgogICAgICAgIDxyZWN0IHdpZHRoPSIxMzgiIGhlaWdodD0iMjAiIHJ4PSIzIiBmaWxsPSIjZmZmIiAvPgogICAgPC9jbGlwUGF0aD4KICAgIDxnIGNsaXAtcGF0aD0idXJsKCNyKSI+CiAgICAgICAgPHJlY3Qgd2lkdGg9IjU1IiBoZWlnaHQ9IjIwIiBmaWxsPSIjNTU1IiAvPgogICAgICAgIDxyZWN0IHg9IjU1IiB3aWR0aD0iODMiIGhlaWdodD0iMjAiIGZpbGw9IiNmZTdkMzciIC8+CiAgICAgICAgPHJlY3Qgd2lkdGg9IjEzOCIgaGVpZ2h0PSIyMCIgZmlsbD0idXJsKCNzKSIgLz4KICAgIDwvZz4KICAgIDxnIGZpbGw9IiNmZmYiIHRleHQtYW5jaG9yPSJtaWRkbGUiIGZvbnQtZmFtaWx5PSJWZXJkYW5hLEdlbmV2YSxEZWphVnUgU2FucyxzYW5zLXNlcmlmIiB0ZXh0LXJlbmRlcmluZz0iZ2VvbWV0cmljUHJlY2lzaW9uIiBmb250LXNpemU9IjExMCI+CiAgICAgICAgPHRleHQgYXJpYS1oaWRkZW49InRydWUiIHg9IjI4NSIgeT0iMTUwIiBmaWxsPSIjMDEwMTAxIiBmaWxsLW9wYWNpdHk9Ii4zIiB0cmFuc2Zvcm09InNjYWxlKC4xKSIgdGV4dExlbmd0aD0iNDUwIj5saWZlY3ljbGU8L3RleHQ+CiAgICAgICAgPHRleHQgeD0iMjg1IiB5PSIxNDAiIHRyYW5zZm9ybT0ic2NhbGUoLjEpIiBmaWxsPSIjZmZmIiB0ZXh0TGVuZ3RoPSI0NTAiPmxpZmVjeWNsZTwvdGV4dD4KICAgICAgICA8dGV4dCBhcmlhLWhpZGRlbj0idHJ1ZSIgeD0iOTU1IiB5PSIxNTAiIGZpbGw9IiMwMTAxMDEiIGZpbGwtb3BhY2l0eT0iLjMiIHRyYW5zZm9ybT0ic2NhbGUoLjEpIiB0ZXh0TGVuZ3RoPSI3MzAiPmV4cGVyaW1lbnRhbDwvdGV4dD4KICAgICAgICA8dGV4dCB4PSI5NTUiIHk9IjE0MCIgdHJhbnNmb3JtPSJzY2FsZSguMSkiIGZpbGw9IiNmZmYiIHRleHRMZW5ndGg9IjczMCI+ZXhwZXJpbWVudGFsPC90ZXh0PgogICAgPC9nPgo8L3N2Zz4K)
dbBindArrow() is experimental, as are the other *Arrow functions.
dbSendQuery() is compatible with dbBindArrow(), and dbSendQueryArrow()
is compatible with dbBind().
Usage
dbBind(res, params, ...)
dbBindArrow(res, params, ...)
Arguments
res |
An object inheriting from DBIResult.
|
params |
For dbBind(), a list of values, named or unnamed,
or a data frame, with one element/column per query parameter.
For dbBindArrow(), values as a nanoarrow stream,
with one column per query parameter.
|
... |
Other arguments passed on to methods.
|
Details
DBI supports parametrized (or prepared) queries and statements
via the dbBind() and dbBindArrow() generics.
Parametrized queries are different from normal queries
in that they allow an arbitrary number of placeholders,
which are later substituted by actual values.
Parametrized queries (and statements) serve two purposes:
-
The same query can be executed more than once with different values.
The DBMS may cache intermediate information for the query,
such as the execution plan, and execute it faster.
-
Separation of query syntax and parameters protects against SQL injection.
The placeholder format is currently not specified by DBI;
in the future, a uniform placeholder syntax may be supported.
Consult the backend documentation for the supported formats.
For automated testing, backend authors specify the placeholder syntax with
the placeholder_pattern tweak.
Known examples are:
-
? (positional matching in order of appearance) in RMariaDB and RSQLite
-
$1 (positional matching by index) in RPostgres and RSQLite
-
:name and $name (named matching) in RSQLite
Value
dbBind() returns the result set,
invisibly,
for queries issued by dbSendQuery() or dbSendQueryArrow() and
also for data manipulation statements issued by
dbSendStatement().
The data retrieval flow
This section gives a complete overview over the flow
for the execution of queries that return tabular data as data frames.
Most of this flow, except repeated calling of dbBind() or dbBindArrow(),
is implemented by dbGetQuery(), which should be sufficient
unless you want to access the results in a paged way
or you have a parameterized query that you want to reuse.
This flow requires an active connection established by dbConnect().
See also vignette("dbi-advanced") for a walkthrough.
-
Use dbSendQuery() to create a result set object of class
DBIResult.
-
Optionally, bind query parameters with dbBind() or dbBindArrow().
This is required only if the query contains placeholders
such as ? or $1, depending on the database backend.
-
Optionally, use dbColumnInfo() to retrieve the structure of the result set
without retrieving actual data.
-
Use dbFetch() to get the entire result set, a page of results,
or the remaining rows.
Fetching zero rows is also possible to retrieve the structure of the result set
as a data frame.
This step can be called multiple times.
Only forward paging is supported, you need to cache previous pages
if you need to navigate backwards.
-
Use dbHasCompleted() to tell when you're done.
This method returns TRUE if no more rows are available for fetching.
-
Repeat the last four steps as necessary.
-
Use dbClearResult() to clean up the result set object.
This step is mandatory even if no rows have been fetched
or if an error has occurred during the processing.
It is good practice to use on.exit() or withr::defer()
to ensure that this step is always executed.
The data retrieval flow for Arrow streams
This section gives a complete overview over the flow
for the execution of queries that return tabular data as an Arrow stream.
Most of this flow, except repeated calling of dbBindArrow() or dbBind(),
is implemented by dbGetQueryArrow(),
which should be sufficient
unless you have a parameterized query that you want to reuse.
This flow requires an active connection established by dbConnect().
See also vignette("dbi-advanced") for a walkthrough.
-
Use dbSendQueryArrow() to create a result set object of class
DBIResultArrow.
-
Optionally, bind query parameters with dbBindArrow() or dbBind().
This is required only if the query contains placeholders
such as ? or $1, depending on the database backend.
-
Use dbFetchArrow() to get a data stream.
-
Repeat the last two steps as necessary.
-
Use dbClearResult() to clean up the result set object.
This step is mandatory even if no rows have been fetched
or if an error has occurred during the processing.
It is good practice to use on.exit() or withr::defer()
to ensure that this step is always executed.
The command execution flow
This section gives a complete overview over the flow
for the execution of SQL statements that have side effects
such as stored procedures, inserting or deleting data,
or setting database or connection options.
Most of this flow, except repeated calling of dbBindArrow(),
is implemented by dbExecute(), which should be sufficient
for non-parameterized queries.
This flow requires an active connection established by dbConnect().
See also vignette("dbi-advanced") for a walkthrough.
-
Use dbSendStatement() to create a result set object of class
DBIResult.
For some queries you need to pass immediate = TRUE.
-
Optionally, bind query parameters withdbBind() or dbBindArrow().
This is required only if the query contains placeholders
such as ? or $1, depending on the database backend.
-
Optionally, use dbGetRowsAffected() to retrieve the number
of rows affected by the query.
-
Repeat the last two steps as necessary.
-
Use dbClearResult() to clean up the result set object.
This step is mandatory even if no rows have been fetched
or if an error has occurred during the processing.
It is good practice to use on.exit() or withr::defer()
to ensure that this step is always executed.
Failure modes
Calling dbBind() for a query without parameters
raises an error.
Binding too many
or not enough values,
or parameters with wrong names
or unequal length,
also raises an error.
If the placeholders in the query are named,
all parameter values must have names
(which must not be empty
or NA),
and vice versa,
otherwise an error is raised.
The behavior for mixing placeholders of different types
(in particular mixing positional and named placeholders)
is not specified.
Calling dbBind() on a result set already cleared by dbClearResult()
also raises an error.
Specification
DBI clients execute parametrized statements as follows:
-
Call dbSendQuery(), dbSendQueryArrow() or dbSendStatement()
with a query or statement that contains placeholders,
store the returned DBIResult object in a variable.
Mixing placeholders (in particular, named and unnamed ones) is not
recommended.
It is good practice to register a call to dbClearResult() via
on.exit() right after calling dbSendQuery() or dbSendStatement()
(see the last enumeration item).
Until dbBind() or dbBindArrow() have been called,
the returned result set object has the following behavior:
-
Call dbBind() or dbBindArrow():
-
For dbBind(), the params argument must be a list where all elements
have the same lengths and contain values supported by the backend.
A data.frame is internally stored as such a list.
-
For dbBindArrow(), the params argument must be a
nanoarrow array stream, with one column per query parameter.
-
Retrieve the data or the number of affected rows from the DBIResult object.
-
For queries issued by dbSendQuery() or dbSendQueryArrow(), call dbFetch().
-
For statements issued by dbSendStatements(),
call dbGetRowsAffected().
(Execution begins immediately after the dbBind() call,
the statement is processed entirely before the function returns.)
-
Repeat 2. and 3. as necessary.
-
Close the result set via dbClearResult().
The elements of the params argument do not need to be scalars,
vectors of arbitrary length
(including length 0)
are supported.
For queries, calling dbFetch() binding such parameters returns
concatenated results, equivalent to binding and fetching for each set
of values and connecting via rbind().
For data manipulation statements, dbGetRowsAffected() returns the
total number of rows affected if binding non-scalar parameters.
dbBind() also accepts repeated calls on the same result set
for both queries
and data manipulation statements,
even if no results are fetched between calls to dbBind(),
for both queries
and data manipulation statements.
If the placeholders in the query are named,
their order in the params argument is not important.
At least the following data types are accepted on input (including NA):
-
integer
-
numeric
-
logical for Boolean values
-
character
(also with special characters such as spaces, newlines, quotes, and backslashes)
-
factor (bound as character,
with warning)
-
Date
(also when stored internally as integer)
-
POSIXct timestamps
-
POSIXlt timestamps
-
difftime values
(also with units other than seconds
and with the value stored as integer)
-
lists of raw for blobs (with NULL entries for SQL NULL values)
-
objects of type blob::blob
See Also
Other DBIResult generics:
DBIResult-class,
dbClearResult(),
dbColumnInfo(),
dbFetch(),
dbGetInfo(),
dbGetRowCount(),
dbGetRowsAffected(),
dbGetStatement(),
dbHasCompleted(),
dbIsReadOnly(),
dbIsValid(),
dbQuoteLiteral(),
dbQuoteString()
Other DBIResultArrow generics:
DBIResultArrow-class,
dbClearResult(),
dbFetchArrow(),
dbFetchArrowChunk(),
dbHasCompleted(),
dbIsValid()
Other data retrieval generics:
dbClearResult(),
dbFetch(),
dbFetchArrow(),
dbFetchArrowChunk(),
dbGetQuery(),
dbGetQueryArrow(),
dbHasCompleted(),
dbSendQuery(),
dbSendQueryArrow()
Other command execution generics:
dbClearResult(),
dbExecute(),
dbGetRowsAffected(),
dbSendStatement()
Examples
con <- dbConnect(RSQLite::SQLite(), ":memory:")
dbWriteTable(con, "iris", iris)
iris_result <- dbSendQuery(con, "SELECT * FROM iris WHERE [Petal.Width] > ?")
dbBind(iris_result, list(2.3))
dbFetch(iris_result)
dbBind(iris_result, list(3))
dbFetch(iris_result)
dbClearResult(iris_result)
iris_result <- dbSendStatement(con, "DELETE FROM iris WHERE [Species] = $species")
dbBind(iris_result, list(species = c("setosa", "versicolor", "unknown")))
dbGetRowsAffected(iris_result)
dbClearResult(iris_result)
nrow(dbReadTable(con, "iris"))
dbDisconnect(con)
con <- dbConnect(RSQLite::SQLite(), ":memory:")
dbWriteTable(con, "iris", iris)
iris_result <- dbSendQueryArrow(con, "SELECT * FROM iris WHERE [Petal.Width] > ?")
dbBindArrow(
iris_result,
nanoarrow::as_nanoarrow_array_stream(data.frame(2.3, fix.empty.names = FALSE))
)
as.data.frame(dbFetchArrow(iris_result))
dbBindArrow(
iris_result,
nanoarrow::as_nanoarrow_array_stream(data.frame(3, fix.empty.names = FALSE))
)
as.data.frame(dbFetchArrow(iris_result))
dbClearResult(iris_result)
iris_result <- dbSendStatement(con, "DELETE FROM iris WHERE [Species] = $species")
dbBindArrow(iris_result, nanoarrow::as_nanoarrow_array_stream(data.frame(
species = c("setosa", "versicolor", "unknown")
)))
dbGetRowsAffected(iris_result)
dbClearResult(iris_result)
nrow(dbReadTable(con, "iris"))
dbDisconnect(con)
