{"record":{"id":"b6c4dc0f202bbe6a","repo":"apache/cassandra","slug":"the-query-contains-only-literal-values-and-no-bind","errorCode":null,"errorMessage":"The query contains only literal values and no bind markers. Using one or more '?' placeholder values (bind markers) allows a prepared statement to be reused. Query executed on keyspace '<keyspace>', table '<table>'.","messagePattern":"The query contains only literal values and no bind markers\\. Using one or more '\\?' placeholder values \\(bind markers\\) allows a prepared statement to be reused\\. Query executed on keyspace '<keyspace>', table '<table>'\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"src/java/org/apache/cassandra/db/guardrails/PreparedStatementParameterRequirementGuardrail.java","lineNumber":63,"sourceCode":"                && !restrictions.hasClusteringColumnsRestrictions()\n                && !restrictions.hasNonPrimaryKeyRestrictions()))\n            return;\n\n        if (!enabled(state))\n            return;\n\n        final GuardrailsConfig config = Guardrails.CONFIG_PROVIDER.getOrCreate(state);\n\n        boolean failOn = config.getPreparedStatementsRequireParametersEnabled();\n        if (!failOn && !config.getPreparedStatementsRequireParametersWarned())\n            return;\n\n        final String message = MISPREPARED_STATEMENT_MESSAGE + \" Query executed on keyspace '\" + keyspace + \"', table '\" + table + \"'.\";\n\n        if (failOn)\n            fail(message, state);\n        else\n            warn(message);\n    }\n}\n\n","sourceCodeStart":45,"sourceCodeEnd":67,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/db/guardrails/PreparedStatementParameterRequirementGuardrail.java#L45-L67","documentation":"PreparedStatementParameterRequirementGuardrail.guard fires when a query executed through the prepared-statement path contains only literal values and no bind markers. Cassandra warns (or fails, if configured) because a prepared statement without placeholders provides no reuse benefit and can cause unbounded prepared-statement cache growth and server-side prepared statement churn.","triggerScenarios":"Driver code calling session.prepare(\"SELECT ... WHERE id = 5\") with literals instead of '?' placeholders, then executing it; ORMs or query builders interpolating values before preparing; executing many distinct literal-only prepared statements on keyspace/table <keyspace>.<table>.","commonSituations":"Application frameworks generating queries with string interpolation; developers misunderstanding prepare() and preparing per-value statements; prepared-station cache pressure alarms leading to this guardrail being enabled.","solutions":["Rewrite the query to use '?' bind markers and supply values via the bound-statement API.","Prepare the statement once and reuse it with different bound values.","If literals are intentional and rare, adjust or disable the prepare_parameters guardrail thresholds in cassandra.yaml."],"exampleFix":"// before\nPreparedStatement ps = session.prepare(\"SELECT * FROM users WHERE id = 5\");\n// after\nPreparedStatement ps = session.prepare(\"SELECT * FROM users WHERE id = ?\");\nsession.execute(ps.bind(5));","handlingStrategy":"validation","validationCode":"// Check a CQL string has bind markers before preparing\nif (!query.contains(\"?\")) {\n    throw new IllegalArgumentException(\"Query must use bind markers: \" + query);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always use '?' placeholders with bound values instead of string interpolation.","Enable this guardrail in dev/staging to catch offenders early.","Reuse a cache of prepared statements instead of preparing per request."],"tags":["cql","prepared-statements","guardrails","driver-usage"],"backgroundTag":"invalid-argument-value","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}