Re: Dynamic SQL using parameter markers vs. embedded SQL using host variables

Am 12.09.2025 um 15:47 schrieb Charles Wilt <charles.wilt@xxxxxxxxx>:

One last tidbit, don't overly complicate the static statement just to use
static.

What I mean is having something like so:
exec sql
select <...>
where col1 =
case when :var1 = 0 then col1 else :var1 end
and col2 =
case when :var2 = '' then col2 else :var2 end
<...>

To have "optional" filters or sorting applied. This takes the "static is a better choice" too far; greatly increasing the difficulty of the optimiser's job.

In these cases, dynamic is a better choice.

Definitely true.

The main error, that a lot of people do in this case, is to create the whole SQL statement in the string, and don't use parameter marker (?) in dynamic SQL. At least I have seen this very often.

I understand the problem, as you might have changing/variable WHERE conditions depending on user input - and it gets complicated very fast. So embedding user input strings into the dynamic SQL statement seems easy and straightforward.

The problem is then, that when parts of the dynamic SQL statement are strings from user input, you risk SQL injections:

-> https://xkcd.com/327/

So I have written a piece about avoiding SQL injections with "really" dynamic SQL statements:

-> https://blog.qpgmr.de/2025/05/24/avoiding-sql-injections.html

So when using dynamic SQL, I really recommend using ? parameter markers and SQL indicators at least for all CHAR or VARCHAR values. And using the technique from my blog post, it's only a bit more complicated than embedding the strings directly.

HTH
Daniel

On Thu, Sep 11, 2025 at 3:14 PM Dan Bale <dan.bale@xxxxxxxxxxxxxxxxxxxxx>
wrote:

We have a lot of embedded SQL that uses host variables, e.g.:
Select a, b, c from custmast where c = :hostc;

It has been suggested to me that this can cause performance issues because
the plan cache may need to be "rebuilt"(?), so we should consider replacing
these type of queries with dynamic SQL using parameter markers, e.g.

SQLStatement = 'Select a, b, c from custmast where c = ?';
Exec SQL Prepare P1 from :SQLStatement;
Exec SQL Declare C1 cursor for P1;
Exec SQL Open C1 USING :hostc;

Is anyone aware of a resource that describes this in detail? Maybe also
provide test cases that prove performance gains? (Or not?)

- Dan Bale
*** CONFIDENTIALITY NOTICE: The information contained in this
communication may be confidential, and is intended only for the use of the
recipients named above. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution, or
copying of this communication, or any of its contents, is strictly
prohibited. If you have received this communication in error, please return
it to the sender immediately and delete the original message and any copy
of it from your computer system. If you have any questions concerning this
message, please contact the sender. ***
--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related
questions.

--
This is the RPG programming on IBM i (RPG400-L) mailing list
To post a message email: RPG400-L@xxxxxxxxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/rpg400-l.

Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.