Re: Re: Use Placeholders. For SECURITY and (sometimes) for PERFORMANCE

[runrig]

Since the query plan is done at prepare time, queries like this can cause a problem:

select * from foo
where bar = ?
and baz like ?

If there are two indexes, one on bar, and one on baz, which should be used? If baz is '%' (nothing but a wildcard), then it would be the wrong index to use, but if it's 'some long prefix%' then it's probably a good index to use, but there's no way to tell at prepare time. Trick: if you know baz is always the wrong index in this case but the database picks that index anyway (and your database does not support hints), you can fool it into not using the index (and hopefully using the correct one) by doing something like this (example also includes how to not use an index on a numeric column):

select * from foo
where bar = ?
and baz || '' like ?
and some_number + 0 = ?

[etcshadow]

Yeah, there are lots of good examples... I was just trying to come up with the very simplest query that would demonstrate the problem.

Honestly, single-table queries aren't likely to be all that problematic, no matter what. You do a full table-scan on a million-row table... well, that's 5 seconds you wish you hadn't spent, but it's not gonna totally kill you, unless it is being hit with great frequency. It's really when you get into large, complicated plans involving lots of joins and various other nasties, that tuning gets to be really critical (except, of course, for very frequently accessed queries).

Somebody could write a whole book on database tuning... oh, wait... several people already have :-P