Prepared statement
SQL pattern: send a query template with placeholders ($1, ?), bind parameters separately. Two main wins: protection against SQL injection (parameters are never interpreted as SQL) + caching of execution plan.
Lifecycle: PREPARE (send template, parser+planner runs) → EXECUTE (send values, run plan). Plan caching: subsequent calls skip parsing+planning, go straight to execute. Trade-off: the planner makes a generic plan (can be suboptimal for specific values). PostgreSQL: after 5 generic-plan calls, it checks whether a custom plan would be better. Connection-pool issue: prepared statements are per session — if pooled connections are shared globally, statements get re-prepared often. PgBouncer transaction-mode breaks prepared statements.