From: Tom Lane <tgl@sss.pgh.pa.us>
To: Scott Carey <scott@richrelevance.com>
Cc: bricklen <bricklen@gmail.com>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: Merlin Moncure <mmoncure@gmail.com>
Cc: pgsql-performance@postgresql.org <pgsql-performance@postgresql.org>
Subject: Re: Poor plan choice in prepared statement
Date: Tue, 30 Dec 2008 18:02:29 -0500
Message-ID: <2796.1230678149@sss.pgh.pa.us> (raw)
In-Reply-To: <BDFBB77C9E07BE4A984DAAE981D19F961ACD5F388E@EXVMBX018-1.exch018.msoutlookonline.net>
References: <33b743250812301059u31ce82faw3d72a38280b37402@mail.gmail.com>
<b42b73150812301142w4483978ahfb819b0313150dbb@mail.gmail.com>
<dcc563d10812301209i59bf612eidc42fa408d4441ab@mail.gmail.com>
<33b743250812301214k7a0ec4fby614d693ec7915d3@mail.gmail.com>
<BDFBB77C9E07BE4A984DAAE981D19F961ACD5F388E@EXVMBX018-1.exch018.msoutlookonline.net>
Scott Carey <scott@richrelevance.com> writes:
> I have also had a case where one query would take a couple hundred ms to parse, but was fairly fast to plan and execute (1/3 the parse cost) -- yet another case where a prepared statement that re-plans each execution would be helpful. At least you can prevent SQL injection and cut the parse cost. Its not all about the cost of planning the query.
The point of a prepared statement IMHO is to do the planning only once.
There's necessarily a tradeoff between that and having a plan that's
perfectly adapted to specific parameter values.
Reasonable client-side APIs should provide the option to use out-of-line
parameters, which is what you want to prevent SQL injection, without
hard-wiring that to the orthogonal concept of statements whose plan is
prepared in advance. In libpq, for instance, PQexecParams() does that.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: tgl@sss.pgh.pa.us, scott@richrelevance.com, bricklen@gmail.com, scott.marlowe@gmail.com, mmoncure@gmail.com
Subject: Re: Poor plan choice in prepared statement
In-Reply-To: <2796.1230678149@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox