Re: SQL injection - Mailing list pgsql-general

From Scott Marlowe
Subject Re: SQL injection
Date
Msg-id 1130869139.15018.58.camel@state.g2switchworks.com
Whole thread Raw
In response to Re: SQL injection  ("Jim C. Nasby" <jnasby@pervasive.com>)
List pgsql-general
On Tue, 2005-11-01 at 12:12, Jim C. Nasby wrote:
> On Tue, Nov 01, 2005 at 11:19:12AM -0600, Scott Marlowe wrote:
> > On Tue, 2005-11-01 at 09:09, Jim C. Nasby wrote:
> > > On Mon, Oct 31, 2005 at 10:13:20PM -0500, Alex Turner wrote:
> > > > I didn't think query plans were cached between sessions, in which case
> > > > prepeared statements aren't worth much for most HTTP based systems
> > > > (not counting luckily re-using the same connection using pgpool)...
> > > >
> > > > Please correct me if I'm mistaken - I like being wrong ;)
> > >
> > > No, you're right, but if you're not using connection pooling you clearly
> > > don't care about performance anyway...
> >
> > Depends on what you mean by performance.  I've written apps that were
> > used by one or two people at once, and spit out 100M at a shot for an
> > excel spread sheet or made huge 100 page pdfs.  They had to run fast,
> > but connection time wasn't an issue.  Since the average run time of
> > those scripts as 1 to 30 seconds, the connect time was absolutely not an
> > issue.
>
> Hrm... what's that quote about stereotyping? :)
>
> Granted, sometimes connection startup time doesn't matter. But in most
> web environments (we are talking PHP here remember) you'll either be
> using a connection pool or not caring at all about performance...

What's that quote about all generalizations?  :)

In all honesty, in a corporate intranet for about 1500 users, with an
average of 10 to 20 logged in at a time, our average page response time
was well under a second, and server was rock solid and stable.  Our
effort was better spent elsewhere, like tuning SQL queries, than
worrying about connection pooling.  It was more a solution in search of
a problem.  This on a site that connected to the database for almost
every page it delivered.

Now, if it was for amazon.com s front page, well, of course, connection
times might well have meant a lot more.  But it wasn't, and performance
was important.  We just didn't have 1,000 users pounding on the door for
a drink of water, we had dozens going to the well with 5 gallon buckets.

pgsql-general by date:

Previous
From: "Jim C. Nasby"
Date:
Subject: Re: SQL injection
Next
From: "A. Kretschmer"
Date:
Subject: Re: replace() and Regular Expressions