Paranoid with performance (session.find)

nerotnt · **Joined:** Wed Oct 08, 2003 10:31 am **Posts:** 247

I would like to know please which one's faster:

Method 1

Code:

List res = session.find("from pt.Xpto as x where x.ref = '" + ref + "'");

Method 2

Code:

List res = session.find("from pt.Xpto as x where x.ref = ?", 
                                ref, 
                                Hibernate.STRING);

Do they produce the same sql code?

Thanks in advance.

drj · **Posted:** Tue Jan 27, 2004 6:03 am

The one using a parameter will produce a (prepared)statement which can be cached and used on subsequent executions of the method. This will probably improve performance in the long run, and is recommended.

Also - you don't need to escape the string for ominous chanacters if using the parameter based version.

My recommendation - 'always' use parameterised queries.

Justin

nerotnt · **Joined:** Wed Oct 08, 2003 10:31 am **Posts:** 247

drj wrote:

The one using a parameter will produce a (prepared)statement which can be cached and used on subsequent executions of the method. This will probably improve performance in the long run, and is recommended.

Also - you don't need to escape the string for ominous chanacters if using the parameter based version.

My recommendation - 'always' use parameterised queries.

Justin

Thanks for the reply.
Please explain the "need to escape the string for ominous chanacters if using the parameter..." part.

christian · **Posted:** Tue Jan 27, 2004 7:02 am

SQL Injection.

http://www.sitepoint.com/article/794

nerotnt · **Joined:** Wed Oct 08, 2003 10:31 am **Posts:** 247

christian wrote:

SQL Injection.

http://www.sitepoint.com/article/794

Thanks all for the advice.