Re: Change in Log Format and Prepared Statements - Mailing list pgsql-jdbc

From Maciek Sakrejda
Subject Re: Change in Log Format and Prepared Statements
Date
Msg-id CAOtHd0Df2_L=k+OxpWgNXso2w298V=D1GY7RDfwczTta=WjaJg@mail.gmail.com
Whole thread Raw
In response to Re: Change in Log Format and Prepared Statements  (Dave Cramer <pg@fastcrypt.com>)
Responses Re: Change in Log Format and Prepared Statements  (Alexander Stanier <alexander.stanier@egsgroup.com>)
List pgsql-jdbc
To clarify, when prepareThreshold is set to zero, the driver still
uses prepared statements, but it uses only the unnamed variant, which
should effectively have no overhead compared to inlining parameters.
The separate log messages are due to this change.

Safely passing in parameters is an important reason to use prepared
statements (perhaps more so than performance), so as to protect
against SQL injection. For what it's worth, based on the logs, it
looks like you're not doing that; you should seriously consider making
that change, especially if data like user names is coming externally.


pgsql-jdbc by date:

Previous
From: Dave Cramer
Date:
Subject: Re: Change in Log Format and Prepared Statements
Next
From: Craig Ringer
Date:
Subject: Re: Bug : FAST_NUMBER_FAILED when getting NaN on BigDecimal