Re: Prepared statements considered harmful

From: Peter Eisentraut <peter_e(at)gmx(dot)net>
To: Andrew Dunstan <andrew(at)dunslane(dot)net>
Cc: pgsql-hackers(at)postgresql(dot)org
Subject: Re: Prepared statements considered harmful
Date: 2006-08-31 14:52:56
Message-ID: 200608311652.56930.peter_e@gmx.net
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Am Donnerstag, 31. August 2006 16:26 schrieb Andrew Dunstan:
> Cached plans etc. might have an impact, but please do not overlook the
> benefits of parameterized queries in avoiding SQL injection attacks, as
> well as often being much cleaner to code.

That might be part of the confusion. Composing queries with the variable
parameters out of line is a very nice feature. But that concept is totally
independent of the question whether the execution plan should be cached. The
APIs (and their documentations) just don't convey that very well.

--
Peter Eisentraut
http://developer.postgresql.org/~petere/

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message elein 2006-08-31 15:03:27 Re: gBorg status?
Previous Message Peter Eisentraut 2006-08-31 14:42:27 Re: Prepared statements considered harmful