sql - explain differences between two different updates -
i have 2 different update query's, 1 created:
update_query = "" update_query = update_query & "update orgbhvtasklist " update_query = update_query & "set taskid = null " update_query = update_query & "where taskid = ? " set cmd = server.createobject("adodb.command") cmd.activeconnection = objcon cmd.commandtext = update_query set paramid = cmd.createparameter("@id", 3, 1, , taskid) cmd.parameters.append paramid cmd.execute
my colleague preferred one:
update_query = "" update_query = update_query & "select taskid " update_query = update_query & "from orgbhvtasklist " update_query = update_query & "where taskid = "&taskid&" " set objupdate = server.createobject("adodb.recordset") objupdate.cursortype = 2 objupdate.locktype = 3 objupdate.open update_query, objcon objupdate.fields("taskid") = null objupdate.update objupdate.close set objupdate = nothing
he can't explain wich 1 should better , neither can i. difference have, update on second query crash when there no results update.
can explain what's difference?
to sum up:
the first approach (parameterized query/prepared statement) best, because it
- is easy: automagical quoting , formatting of parameters
- can more efficient: dbms may optimize
- avoids fetching , storing resultset (@ansgar)
- scales better: work many records without change
- guards against sql-injection
the second approach worse because not having features 1 - 5 , worst/naive because not checking empty recordset (@peter, @cageman).
Comments
Post a Comment