Thanks Maciek for your advice which I will pass back to our Java developers. We are using a combination of Torque and Hibernate to access the database via jdbc. I think Hibernate passes parameters as you suggest but Torque doesn't. We are slowly moving away from Torque to Hibernate.

Do you know if there is any documentation on the "unnamed variant" of prepared statements? I've read the pages on PREPARE and EXECUTE but they don't go into much depth about what happens in the background.

Alex Stanier.

On 13/09/2012 21:12, Maciek Sakrejda wrote:

To clarify, when prepareThreshold is set to zero, the driver still
uses prepared statements, but it uses only the unnamed variant, which
should effectively have no overhead compared to inlining parameters.
The separate log messages are due to this change.

Safely passing in parameters is an important reason to use prepared
statements (perhaps more so than performance), so as to protect
against SQL injection. For what it's worth, based on the logs, it
looks like you're not doing that; you should seriously consider making
that change, especially if data like user names is coming externally.


This email has been scanned for viruses by Blackspider's Mail Control System. 
For more information please visit http://www.blackspider.com

This message has been scanned for malware by SurfControl plc. www.surfcontrol.com