Why is preparestatement better and safer?

The reality of the industry is that interview requirements are large and comprehensive , Actual work CRUD. I used to think about building databases , What performance optimization , What cache . All are DBA What to consider , Let's just do it CRUD. what ？ Your company even DBA None ？ Too far behind ？ Now find , Used to be a frog in a well , No chance to encounter performance problems , Not without performance problems . Now basically go out for an interview ,SQL Optimize , Database optimization ,JDBC The underlying principles are hard indicators . No gossip , Let's get started .

We Java use SQL Operating the database , There are two ways ：

  For direct submission Statement

statement.executeUpdate("UPDATE Users SET stateus = 2 WHERE userID=233");

  precompile PrepareStatement

PreparedStatement updateUser = con.prepareStatement("UPDATE Users SET stateus = ? WHERE userID = ?"); 
updateUser.setInt(1, 2); 
updateUser.setInt(2,233); 
updateUser.executeUpdate();

Obviously ,Statement It looks better than PrepareStatement Make it simple . But some ORM Frame image Mybites Both adopt the second . Why not use complex ones instead of simple ones ？ This soul torture is not simple , You need to understand the database architecture and the principle of file storage to answer .

Database architecture and SQL Execution process

1. Database architecture principle and SQL Execution process

Relational database system RDBMS There are many kinds of , But the relational database architecture is similar , Including support SQL Of Hadoop It's the same thing .

With Mysql For example, it can be divided into two layers ,,server Layer and storage engine layer ,server contain The connector , The query cache , parsers , Semantic analysis and optimizer and execution engine These components . All cross-storage engine functionality is implemented in this layer , such as stored procedure , View , trigger etc.

The storage engine is responsible for data storage and extraction , Different storage engines actually store data in different ways .Mysql The storage engine has InnoDB,MYSIAM,Memory etc. . from Mysql 5.5.5 The default storage engine after version is InnoDB. That is, if you want to use other storage engines , It needs to be in create table Special designation when, for example engine=memory. About InnoDB,MYSIAM Storage principle of storage engine , Write a blog later .

Now disassemble Server layer .

The connector

To follow Client Establishing a connection （ When it comes to establishing connections, what you have to know is TCP Three handshakes ）、 Verification authority 、 Maintaining and managing connections .

1. stay TCP After three handshakes, start to check the user name and password , If not , You will receive "Access denied for user" Error of , Then the client ends execution
2. After the user name and password are verified , Start reading permission table , Later permission verification logic depends on the permissions read during this connection

That is to say, even if you modify the permission table after this connection , Also wait until the next time you create a new connection , This connection permission is also the permission read after the connection is created .

After the connection is established , If the client does not send data , If you change the connection, it will be in the idle sleep state ,Mysql The default timeout disconnection time is 8h, This is by wait_timeout This parameter determines . That is to say, more than 8h After the client sends the request, it will report an error ：connection to MySQL server during query At this time, you can only re-establish the connection to do things

Connections are divided into long connections and segment connections

1. A long connection ： The client uses the same connection for successive requests
2. Short connection ： The client requests the same connection for a limited number of times , Disconnect after the request is completed , If you need to request again , The connection needs to be reestablished

  The establishment of connection is a very complicated process , It takes a certain amount of time CPU resources , So avoid frequent threading and destruction of connections . Use long connections whenever possible . But there is also a problem with long connections when the connection is idle , It still takes up resources , Accumulated for a long time, the performance is CPU completely fill ,OOM, Finally, it was restarted .

Solve this problem ：

1. Disconnect and re-establish the connection after each large number of queries
2. Mysql 5.7 And above , After a relatively large operation , It can be used mysql_reset_connection To initialize the connection resource . No need to disconnect , You can restore the connection to the state it was just established

Since each connection is actually a thread , With or without SQL Submit , Will consume a certain amount of memory resources . And now it's popular ORM Frame image Mybites That's right JDBC Encapsulation , So a large-scale cluster starts several instances , Each instance is connected to the database , Such database memory resources are unbearable . So the program should manage the connection through the connection pool , Clean up idle connections . The use of the microservice framework has also been optimized .

The query cache

After the connection is established, you will first check the query cache , The result of the previous query will be Key：Value Is stored in the query cache ,key Is a query statement ,value Is the query result . If it hits, it will return directly value, If it does not hit, the following follow-up procedure will be executed , After the query is completed, it will be saved into the cache . Although query caching can greatly improve query performance , But in reality, we only do query caching on some fixed and variable data . If the data is updated frequently , Every time a table is updated, all query caches of the table will be emptied , So hard created cache , It failed before it could be used , No need at all .

Fortunately MySQL Provides the option of using query cache on demand . No query cache is required, and parameters can be query_cache_type Set to DEMAND, If you want to specify query caching for a query, you only need to use SQL_CACHE Appoint , Such as ：

mysql> select SQL_CACHE * from T where ID=10;

It should be noted that MySQL 8.0 And later versions have completely removed the function of query cache .

parsers

Connector received SQL Then I handed it to parsers , The function of the parser is to analyze SQL Sentence syntax , Finally, generate the syntax tree AST.SQL Statement does not conform to syntax , Errors will be reported when generating the syntax tree , For example, deliberately write wrong where by whee：

mysql> explain select * from users whee id = 1;

ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'id = 1' at line 1

  The parser is parsing whee There is no error reported when , because whee It could be users Another name for , until di = 1 Just reported the mistake , So there is “near 'id = 1' at line 1”.

Syntax tree is not only used for syntax checking , still The foundation of semantic analysis and optimizer , In ensuring the original SQL Under the premise of unchanging semantics , Pricing conversion of some sentences , For example, the following SQL

select f.id from orders f where f.user_id = (select id from users);

Semantically equivalent to ：

select f.id from orders f join users u on f.user_id = u.id;

Semantic analysis and optimizer It is for complex nested SQL sentence , Semantic equivalence transformation . And optimize according to the index and other information . This is the black technology of various databases . The semantic analysis and optimizer finally outputs an execution plan by Execution engine Complete execution . This execution engine is replaceable , Say that the execution engine may not be familiar , The storage engine is familiar .MYSQL Of innoDB、MyISAM etc. , Only the storage structure adopted by the underlying implementation is different , But the execution plan is universal .Mysql We can specify the execution engine when creating the table .Hive The implementation plan of Hadoop It is also executable .

2.PrepareStatement perform SQL The benefits of

PrepareStatement There are two advantages ：

The first advantage is the ability to pre submit with placeholders SQL To the database , Generate an execution plan in advance . When given placeholder parameters , True execution SQL At the time of statement , The execution engine can directly execute . This will be more efficient .

The second benefit is to prevent SQL Inject , such as , Not used PrepareStatement perform SQL, Suppose the following query conditions username  Is a string entered by the user . User input Alan

select * from users where username = 'Alan';

But if the string entered by the user is

Alan';drop table users;--

  that sql The sentence becomes

select * from users where username = 'Alan';drop table users;--'

Obviously , This is string splicing . When executed , These are two sql sentence , The last one is deleted directly users surface , As a result, all people and services cannot access this table , The crash leads to .

It was used PrepareStatement After the SQL Precompile , Use a placeholder for the parameters that need user input ？ Instead of

select * from users where username =?

At this time, the execution plan has been generated , It is impossible to regenerate into new sql, So there won't be sql Injection problem , Will not be attacked .

Add a little more ,Mybites Inside we are mapper.xml It is best to write user input parameters in '#{}' instead of '${}', as a result of '${}' Will not participate in precompiling , Before precompiling, it is generated by string splicing SQL. and '#{}' Will participate in pre compilation , It was replaced by ? Place holder , Like the example above . But some scenes have to be used '${}', For example, the query parameter is the table name . This requires us to carefully limit this operation .