Performance – Inline SQL vs Parameterized Queries

In the search for better and better performance, there are many techniques developers can use.  A technique used early on by some entry level or “still learning” developers is to build inline SQL.  That looks something like this:

string name = "Mark";
string query = "SELECT * FROM users WHERE FirstName='" + name + "'";
OleDbCommand cmd = new OleDbCommand(query);
OleDbDataReader reader = cmd.ExecuteReader();

There are steps missing… this is just example code

 

This is something more seasoned developers learn to avoid almost immediately.  There’s a variety of reasons why inline SQL is bad.  The most important reason is security.

However, there’s another reason to avoid it.  Performance.

Data Auditing

For work, we are going to have to have a complete audit trail of all our data.  Here’s the strategy I’m planning on implementing.

Data Segregation in a multi-tenant system

God that’s a sexy title!  Hahah…

This post is all about keeping customer data out of the hands of other customers.  There are many options that can be implemented.  I found three likely candidates and chose one.  Here’s the one I chose and why I chose it.