sql - explain differences between two different updates -


i have 2 different update query's, 1 created:

update_query = "" update_query = update_query & "update orgbhvtasklist " update_query = update_query & "set taskid = null " update_query = update_query & "where taskid = ? "  set cmd = server.createobject("adodb.command") cmd.activeconnection = objcon cmd.commandtext = update_query  set paramid = cmd.createparameter("@id", 3, 1, , taskid)  cmd.parameters.append paramid  cmd.execute 

my colleague preferred one:

update_query = "" update_query = update_query & "select taskid " update_query = update_query & "from orgbhvtasklist " update_query = update_query & "where taskid = "&taskid&" "  set objupdate = server.createobject("adodb.recordset") objupdate.cursortype = 2 objupdate.locktype = 3 objupdate.open update_query, objcon  objupdate.fields("taskid") = null objupdate.update  objupdate.close set objupdate = nothing 

he can't explain wich 1 should better , neither can i. difference have, update on second query crash when there no results update.

can explain what's difference?

to sum up:

the first approach (parameterized query/prepared statement) best, because it

  1. is easy: automagical quoting , formatting of parameters
  2. can more efficient: dbms may optimize
  3. avoids fetching , storing resultset (@ansgar)
  4. scales better: work many records without change
  5. guards against sql-injection

the second approach worse because not having features 1 - 5 , worst/naive because not checking empty recordset (@peter, @cageman).


Comments

Popular posts from this blog

java - Plugin org.apache.maven.plugins:maven-install-plugin:2.4 or one of its dependencies could not be resolved -

Round ImageView Android -

How can I utilize Yahoo Weather API in android -