Beefy Boxes and Bandwidth Generously Provided by pair Networks
more useful options
 
PerlMonks  

Re^2: Best practices for closing database connections?

by Polyglot (Chaplain)
on Mar 17, 2022 at 11:28 UTC ( [id://11142169]=note: print w/replies, xml ) Need Help??


in reply to Re: Best practices for closing database connections?
in thread Best practices for closing database connections?

Thank you for the tips and those links. Those are helpful.

The problem I have with understanding or using placeholders, as mentioned in the first link, is that my queries are all different. For example, I query the user's privileges, usage statistics, preferences, the language parameters for the browser interface, the content for various divs on the page, etc., in addition to setting certain parameters in the database such as updating the user's last login/connection time. Much of this is repeated with each subsequent AJAX-driven request from the client's browser, but each time it is a new and separate calling of the script. There's hardly a single query that would be consistently run multiple times within a single execution of the script, so I am baffled as to the benefits of placeholders in such a case.

In fact, seeing as each of these queries originates in a separate subroutine of the script, it will be challenging enough for me to open one global connection for all such queries and then close it before the script exits, rather than opening the connection for each query as I have done to date.

Blessings,

~Polyglot~

Replies are listed 'Best First'.
Re^3: Best practices for closing database connections?
by hippo (Bishop) on Mar 17, 2022 at 12:19 UTC
    I am baffled as to the benefits of placeholders in such a case.

    I strongly recommend that you type "SQL injection attack" into your search engine of choice.

    See also: Little Bobby Tables.


    🦛

      Thank you for the reminder. In my case, the following points seem pertinent.

      1. No one accesses these webpages/queries without logging in, and those logging in are definitely not computer-savvy enough to deliberately inject code such as for dropping tables; much less would they have the desire, seeing as it is their own work at stake.

      2. I like that cartoon, and based on seeing that some time back I actually did create a subroutine that sanitizes the query before passing it to the database.

      3. I still don't understand how placeholders would be implemented in my case without creating less efficiency in my code--as opposed to streamlining it. Is it not the case that the main purpose is to make the queries run more efficiently?

      Blessings,

      ~Polyglot~

        even ignoring hackers and deliberate wrong input:

        as soon as you have legitimate input such as
        • person names like O'Brien
        • company names like Toys “R” Us (or even the older version Toys Я Us
        placeholders are way better than coping with the necessary quoting.

        "No one accesses these webpages/queries without logging in, and those logging in are definitely not computer-savvy enough to deliberately inject code such as for dropping tables; much less would they have the desire, seeing as it is their own work at stake."

        Don't assume the attack vector, e.g. Cross-site_request_forgery, a user click a specially crafted link in an email, say hello to little Bobby Tables.

        Update: how do placeholders and bind variables make things significantly less efficient?

        What is considered the best practice?

        Using placeholders is best practice. Arguing against best practices makes no sense.

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://11142169]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others drinking their drinks and smoking their pipes about the Monastery: (4)
As of 2024-04-23 06:14 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found