Re: Prepared statements considered harmful - Mailing list pgsql-hackers

From Peter Eisentraut
Subject Re: Prepared statements considered harmful
Date
Msg-id 200608311652.56930.peter_e@gmx.net
Whole thread Raw
In response to Prepared statements considered harmful  (Peter Eisentraut <peter_e@gmx.net>)
List pgsql-hackers
Am Donnerstag, 31. August 2006 16:26 schrieb Andrew Dunstan:
> Cached plans etc. might have an impact, but please do not overlook the
> benefits of parameterized queries in avoiding SQL injection attacks, as
> well as often being much cleaner to code.

That might be part of the confusion.  Composing queries with the variable 
parameters out of line is a very nice feature.  But that concept is totally 
independent of the question whether the execution plan should be cached.  The 
APIs (and their documentations) just don't convey that very well.

-- 
Peter Eisentraut
http://developer.postgresql.org/~petere/


pgsql-hackers by date:

Previous
From: Theo Schlossnagle
Date:
Subject: Re: Prepared statements considered harmful
Next
From: Tom Lane
Date:
Subject: Re: [PATCHES] Updatable views