We are at the beginning of a new project, and we are really wondering if we should use stored procedures in MySQL or not.
We would use the stored procedures only to insert and update business model entities. There are several tables which represent a model entity, and we would abstract it in those stored procedures insert/update.
On the other hand, we can call insert and update from the Model layer but not in MySQL but in PHP.
In your experience, Which is the best option? advantages and disadvantages of both approaches. Which is the fastest one in terms of high performance?
PS: It is is a web project with mostly read and high performance is the most important requisite.
Unlike actual programming language code, they:
not portable (every db has its own version of PL/SQL. Sometimes different versions of the same database are incompatible - I've seen it!)
not easily testable - you need a real (dev) database instance to test them and thus unit testing their code as part of a build is virtually impossible
not easily updatable/releasable - you must drop/create them, ie modify the production db to release them
do not have library support (why write code when someone else has)
are not easily integratable with other technologies (try calling a web service from them)
they use a language about as primitive as Fortran and thus are inelegant and laborious to get useful coding done, so it is difficult to express business logic, even though typically that is what their primary purpose is
do not offer debugging/tracing/message-logging etc (some dbs may support this - I haven't seen it though)
lack a decent IDE to help with syntax and linking to other existing procedures (eg like Eclipse does for java)
people skilled in coding them are rarer and more expensive than app coders
their "high performance" is a myth, because they execute on the database server they usually increase the db server load, so using them will usually reduce your maximum transaction throughput
inability to efficiently share constants (normally solved by creating a table and questing it from within your procedure - very inefficient)
etc.
If you have a very database-specific action (eg an in-transaction action to maintain db integrity), or keep your procedures very atomic and simple, perhaps you might consider them.
Caution is advised when specifying "high performance" up front. It often leads to poor choices at the expense of good design and it will bite you much sooner than you think.
Use stored procedures at your own peril (from someone who's been there and never wants to go back). My recommendation is to avoid them like the plague.
Unlike programming code, they:
render SQL injection attacks almost
impossible (unless you are are
constructing and executing dynamic
SQL from within your procedures)
require far less data to be sent over
the IPC as part of the callout
enable the database to far better
cache plans and result sets (this is
admittedly not so effective with
MySQL due to its internal caching
structures)
are easily testable in isolation
(i.e. not as part of JUnit tests)
are portable in the sense that they
allow you to use db-specific
features, abstracted away behind a
procedure name (in code you are stuck
with generic SQL-type stuff)
are almost never slower than SQL
called from code
but, as Bohemian says, there are plenty of cons as well (this is just by way of offering another perspectve). You'll have to perhaps benchmark before you decide what's best for you.
As for performances, they have the potential to be really performant in a future MySQL version (under SQL Server or Oracle, they are a real treat!). Yet, for all the rest... They totally blow up competition. I'll summarize:
Security: You can give your app the EXECUTE right only, everything is fine. Your SP will insert update select ..., with no possible leak of any sort. It means global control over your model, and an enforced data security.
Security 2: I know it's rare, but sometimes php code leaks out from the server (i.e. becomes visible to public). If it includes your queries, possible attackers know your model. This is pretty odd but I wanted to signal it anyway
Task force: yes, creating efficient SQL SPs requires some specific resources, sometimes more expensive. But if you think you don't need these resources just because you're integrating your queries in your client... you're going to have serious problems. I'd mention the analogy of web development: it's good to separate the view from the rest because your designer can work on their own technology while the programmers can focus on programming the business layer.
Encapsulating business layer: using stored procedures totally isolates the business where it belongs: the damn database.
Quickly testable: one command line under your shell and your code is tested.
Independence from the client technology: if tomorrow you'd like to switch from php to something else, no problem. Ok, just storing these SQL in a separate file would do the trick too, that's right. Also, good point in the comments about if you decide to switch sql engines, you'd have a lot of work to do. You have to have a good reason to do that anyway, because for big projects and big companies, that rarely happens (due to the cost and HR management mostly)
Enforcing agile 3+-tier developments: if your database is not on the same server than your client code, you may have different servers but only one for the database. In that case, you don't have to upgrade any of your php servers when you need to change the SQL related code.
Ok, I think that's the most important thing I had to say on the subject. I developed in both spirits (SP vs client) and I really, really love the SP style one. I just wished Mysql had a real IDE for them because right now it's kind of a pain in the ass limited.
Stored procedures are good to use because they keep your queries organized and allow you to perform a batch at once. Stored procedures are normally quick in execution because they are pre-compiled, unlike queries that are compiled on every run. This has significant impact in situations where database is on a remote server; if queries are in a PHP script, there are multiple communication between the application and the database server - the query is send, executed, and result thrown back. However, if using stored procedures, it only need to send a small CALL statement instead of big, complicated queries.
It might take a while to adapt to programming a stored procedure because they have their own language and syntaxes. But once you are used to it, you'll see that your code is really clean.
In terms of performance, it might not be any significant gain if you use stored procedures or not.
I will let know my opinion, despite my toughts possibly are not directly related to the question.:
As in many issues, reply about using Stored Procedures or an application-layer driven solution relies on questions that will drive the overall effort:
What you want to get.
Are you trying to do either batch operations or on-line operations? are they completely transactional? how recurrent are those operations? how heavy is the awaited workload for the database?
What you have in order to get it.
What kind of database technology you have? What kind of infrastucture? Is your team fully trained in the database technology? Is your team better capable of building a database-aegnostic solution?
Time for get it.
No secrets about that.
Architecture.
Is your solution required to be distributed onto several locations? is your solution required to use remote communications? is your solution working on several database servers, or possibly using a cluster-based architecture?
Mainteinance.
How much is the application required to change? do you have personal specifically trained for maintain the solution?
Change Management.
Do you see your database technology will change at a short, middle, long time? do you see will be required to migrate the solution frequently?
Cost
How much will cost to implement that solution using one or another strategy?
The overall of those points will drive the answer. So you have to care each of this points when making a decision about using or not any strategy. There are cases where using of stored procedures are better than application-layer managed queries, and others when, conducting queries and using an application-layer based solution is best.
Using of stored procedures tends to be more addequate when:
Your database technology isn't provided to change at a short time.
Your database technology can handle parallelized operations, table partitions or anything else strategy for divide the workload onto several processors, memory and resources (clustering, grid).
Your database technology is fully integrated with the stored proceduce definition language, that is, support is inside the database engine.
You have a development team who aren't afraid about using a procedural language (3rd. Generation language) for getting a result.
Operations you wanna achieve are built-in or supported inside the database (Exporting to XML data, managing data integrity and coherence appropiately with triggers, scheduled operations, etc).
Portability isn't an important issue and you do not whatch a technology change at a short time into your organization, even, it is not desirable. Generally, portability is seen like a milestone by the application-driven and layered-oriented developers. From my point of view, portability isn't an issue when your application isn't required to be deployed for several platforms, less when there are no reasons for making a technology change, or the effort for migrating all the organizational data is higher than the benefit for making a change. What you can win by using an application-layer driven approach (portability) you can loose in performance and value obtained from your database (Why to spend thousands of dollars for to get a Ferrari that you'll drive no more than 60 milles/hr?).
Performance is an issue. First: In several cases, you can achieve better results by using a single stored procedure call than multiple requests for data from another application. Moreover, some characteristics you need to perform may be built-in your database and its use less expensive in terms of workload. When you use an application-layer driven solution you have to take in account the cost associated to make database connections, making calls to the database, network traffic, data wrapping (i.e., using either Java or .NET, there is an implicit cost when using JDBC/ADO.NET calls as you have to wrap your data into objects that represents the database data, so instantiation has an associated cost in terms of processing, memory, and network when data comes from and goes to outside).
Using of application-layer driven solutions tends to be more addequate when:
Portability is an important issue.
Application will be deployed onto several locations with only one or few database repositories.
Your application will use heavy business-oriented rules, that need to be agnostic of the underlying database technology.
You have in mind to do change technology providers based on market tendencies and budget.
Your database isn't fully integrated with the stored procedure language that calls to the database.
Your database capabilities are limited and your requirement goes beyond what you can achieve with your database technology.
Your application can support the penalty inherent to external calls, is more transactional-based with business-specific rules and has to abstract the database model onto a business model for the users.
Parallelizing database operations isn't important, moreover, your database has not parallelization capabilities.
You have a development team which is not well-trained onto the database technology and is better productive by using an application-driven based technology.
Hope this may help to anyone asking himself/herself what is better to use.
I would recommend you don't use stored procedures:
Their language in MySQL is very crappy
There is no way to send arrays, lists, or other types of data structure into a stored procedure
A stored procedure cannot ever change its interface; MySQL permits neither named nor optional parameters
It makes deploying new versions of your application more complicated - say you have 10x application servers and 2 databases, which do you update first?
Your developers all need to learn and understand the stored procedure language - which is very crap (as I mentioned before)
Instead, I recommend to create a layer / library and put all your queries in there
You can
Update this library and ship it on your app servers with your app
Have rich data types, such as arrays, structures etc passed around
Unit test this library, instead of the stored procedures.
On performance:
Using stored procedures will decrease the performance of your application developers, which is the main thing you care about.
It is extremely difficult to identify performance problems within a complicated stored procedure (it is much easier for plain queries)
You can submit a query batch in a single chunk over the wire (if CLIENT_MULTI_STATEMENTS flag is enabled), which means you don't get any more latency without stored procedures.
Application-side code generally scales better than database-side code
If your database is complex and not a forum type with responses, but true warehousing SP will definitely benefit. You can out all your business logic in there and not a single developer is going to care about it, they just call your SP's. I have been doing this joining over 15 tables is not fun, and you cannot explain this to a new developer.
Developers also don't have access to a DB, great! Leave that up to database designers and maintainers. If you also decide that the table structure is going to get changed, you can hide this behind your interface. n-Tier, remember??
High performance and relational DB's is not something that goes together, not even with MySQL InnoDB is slow, MyISAM should be thrown out of the window by now. If you need performance with a web-app, you need proper cache, memcache or others.
in your case, because you mentioned 'Web' I would not use stored procedures, if it was data warehouse I would definitely consider it (we use SP's for our warehouse).
Tip:
Since you mentioned Web-project, ever though about nosql sort of solution? Also, you need a fast DB, why not use PostgreSQL? (trying to advocate here...)
I used to use MySql and my understanding of sql was poor at best, I spent a fair amount of time using Sql Server, I have a clear separation of a data layer and an application layer, I currently look after a server with 0.5 terabytes.
I have felt frustrated at times not using an ORM as development is really quick with stored procedures it is much slower. I think much of our work could have been sped up by using an ORM.
When your application reaches critical mass, the ORM performance will suffer, a well written stored procedure, will give you your results faster.
As an example of performance I collect 10 different types of data in an application, then convert that to XML, which I process in the stored procedure, I have one call to the database rather than 10.
Sql is really good at dealing with sets of data, one thing that gets me frustrated is when I see someone getting data from sql in a raw form and using application code to loop over the results and format and group them, this really is bad practice.
My advice is to learn and understand sql enough and your applications will really benefit.
Lots of info here to confuse people, software development is a evolutionary. What we did 20 years ago isn't best practice now. Back in the day with classic client server you wouldnt dream of anything but SPs.
It is absolutely horses for courses, if you are a big organisation with you will use multi tier, and probably SPs but you will care little about them because a dedicated team will be sorting them out.
The opposite which is where I find myself trying to quickly knock up a web app solution, that fleshes out business requirements, it was super fast to leave the developer (remote to me) to knock up the pages and SQL queries and I define the DB structure.
However complexity is growing and without an easy way to provide APIs, I am staring to use SPs to contain the business logic. I think it is working well and sensible, I control this because I can build logic and provide a simple result set for my offshore developer to build a front end around.
Should I find my software a phenomenal success, then more separation of concerns will occur and different implementations of n teir will come about but for now SPs are perfect.
You should know all the tool sets available to you and match them is wise to start with. Unless you are building an enterprise system to start with then fast and simple is best.
I would recommend that you stay away from DB specific Stored Procedures.
I've been through a lot of projects where they suddently want to switch DB platform and the code inside a SP is usually not very portable = extra work and possible errors.
Stored Procedure development also requires the developer to have access directly to the SQL-engine, where as a normal connection can be changed by anyone in the project with code-access only.
Regarding your Model/layer/tier idea: yes, stick with that.
Website calls Business layer (BL)
BL calls Data layer (DL)
DL calls whatever storage (SQL, XML, Webservice, Sockets, Textfiles etc.)
This way you can maintain the logic level between tiers. IF and ONLY IF the DL calls seems to be very slow, you can start to fiddle around with Stored Procedures, but maintain the original none-SP code somewhere, if you suddently need to transfer the DB to a whole new platform. With all the Cloud-hosting in the business, you never know whats going to be the next DB platform...
I keep a close eye on Amazon AWS of the very same reason.
I think there is a lot of misinformation floating around about database stored queries.
I would recommend using MySQL Stored Procedures if you're doing many static queries for data manipulation. Especially if you're moving things from one table to another (i.e. moving from a live table to a historical table for whatever reason). There are drawbacks of course in that you'll have to keep a separate log of changes to them (you could in theory make a table that just holds changes to the stored procedures that the DBA's update). If you have many different applications interfacing with the database, especially if say you have a desktop program written in C# and a web program in PHP, it might be more beneficial to have some of your procedures stored in the database as they are platform independent.
This website has some interesting information on it you may find useful.
https://www.sitepoint.com/stored-procedures-mysql-php/
As always, build in a sandbox first, and test.
Try to update 100,000,000 records on a live system from a framework, and let me know how it goes. For small apps, SPs are not a must, but for large serious systems, they are a real asset.
I'm going to rebuilt an existing moderate-scale web-app to be used for a supply-chain-management web-solution. The core would be around some Item\Site combination-records, Organization\User management, display Organization specific data (a dashboard with 2 levels of Grid) and a Drilldown which has some complex calculations for Item transactions and a robust Grid to show multiple level of totals, sub-totals, etc...
In past, I had developed it using
ASP.Net 2.0 and ADO.Net, the backend
is SQL-Server. I'm suppose to migrate
this web-solution to a full fiedge
ASP.Net v3.5 based MVC architecture
and integrate other pieces like
Membership API, Validation-framework,
etc... its going to be a complete
re-design. The performance and
scalability (i.e. handle millions of
records, perform quick calculations,
quick-response-time, etc..) are the
two main priorities. In addition
simplicity and long-term maintenance
and periodic upgrades at any level are
also to be considered.
I was wondering which of the following two would make a robust DAL which meets my above mentioned requirements:
L2S (LINQ to SQL) or EF (Entity
Framework)
I've been searching a lot and based on that I'd like to verify my understanding:
Is L2S like Win98 - strong, stable, simple and performing and -
Is EF something like WinXP - better then win98, also stable in a way but
somewhat more layers so might have a
diff in performance and simplicity
compared to L2S
I don't think we're going to involve 'multiple-databases' in our development, SQL-Server will stay. Also, I don't think we'll need to actually map multiple-tables to an Entity, etc... Generally, we'll have one to one mapping for our DB-tables to Entities (i.e. User, Org, etc..) and for some complex cases - like the dashboard fetches records from multiple tables (most probably we'll need to use a stored-procedure and/or a DB VIEW).
The Drilldown page fetches data from a single table but has many calculations so again we're planning to usa a stored-procedure which will provide us a formatted table (but this table might not look like the ones already present in DB)
So, thats some tricky mapping but apart from that we need to keep things simple, consider performance and scalability. Oh! and last but not the least - we've a tight deadline so its a kind of 'fast-track' development.
Simple, fast, scalable & performing - thats what we need!
Thanks in advance - please guide me.
PS: Ref links:
ORM-LINQ-Entity-Framework-Eric-Nelson
Discuss - LINQ to SQL vs. ADO.NET Entity Framework
Short - ADO.NET Entity Framework When To Use It Vs Linq To SQL
Details - Choosing between ADO.NET Entity Framework and LINQ to SQL
List - Choosing between LINQ to SQL and Entity Framework
I like the comparrison of L2Sql as Win98, but I would compare the EF to Vista ... it's got lots of power potentially but bits left undone until they came out with the next version make it like a death of a thousand cuts.
I am looking foward to the EF 4 ... I am hoping it is Windows 7 to stay with your analogy.
I don't think you can go wrong with Linq to sql. It has it's quirks but it works. We decided to go with L2S even though there are issues with using multiple data contexts.
For fast DAL generation check out plinqo It requires Codesmith to generate the code but it can do a lot and addresses some of the quirks linq to sql has. Also there is Oleg Sych T4 templates which is free and built into VS2008.
If you can't wait until entity v2 is out, which is .net 4.0, I would say go with linq 2 sql.
You can switch to entity later on if you need it.
I did play a little with entity v1, and I think it is still a baby that need to grow up a little.
Another reason for linq 2 sql is the fact that you will work with sql server only and it's a fast track project.
In my personal opinion, having used all of the things you mentioned, i would use NHibernate over either Linq2sql or Entity. If you are after a simple CRUD site, then the decision doesn't matter too much, but the ability to separate the business layer from the data layer is quite difficult to accomplish in ADO.Net, where as it's a lot simpler (in my opinion with Nhibernate).
As I say, opinions vary hugely in this area.
Does anyone have any pointers to information on techniques for object database to relational database conversion?
I've done the standard searches and have only come up with Data Conversion from Object-Oriented to Relational database so far. It's a good paper, but I was hoping for more....
I should have that here somewhere, let me look, it should be somewhere close to that paper Upgrading from c# to cobol :)
Basically all documentation on ORM technology (like Hibernate, Toplink) can help you. You'll probably run into issues getting good performance, handling behaviour, and object versions.
[edit]
An object database for a c program? Or a persistence engine (like ctree?)
[edit2]
So it's not an object database but a persistence engine, no object versions, storing of behaviour? Then the general style could be of a network or hierarchical database. What API do you have? Can you intercept calls?
Which ODBMS are you converting from? If it's simply a matter of scalability or functionality you should consider moving to a commercial ODBMS or db4objects. If the application uses an ODBMS because an RDBMS wasn't performing well then moving back to one probably isn't a good idea. If you have to move to an RDBMS for another reason I'd look at Hibernate, but there will be a performance penalty and you'll have to maintain the mapping layer forever.
Why should we use LINQtoSQL when ADO.NET is giving us better performance?
Checkout this link which shows the comparison reports
I am looking for Speed /Performance of my application rather than deployment easiness. Is there anything else which should we considered before i leave LINQ to SQL and go back to my OLD ADO.NET DataAcces Layer which user stored procedures ?
How often do you execute 2000 identical queries? This is a purely synthetic test which does not show a thing.
Generally speaking, it's much easier (and cost-effective) to throw more hardware at a problem (add more dirt-cheap RAM to an SQL Server machine) than to spend thousands of dollars and hundreds of man-hours trying to eliminate all bugs in
var dataReader = command.ExecuteReader();
while(dataReader.Read())
var id = dataReader.GetInt32("ID");
Granted, sometimes one needs to resort to plain ADO.NET to increase performance, but this should be done only where profiler shows a problem.
One of an ORMs biggest advantages over ADO.NET is in initial development speed (not application speed). Maintenance can also be much easier with an ORM than with ADO.NET. ORMs offer many features that would need to be coded by hand with ADO.NET. Linq does not work with ADO.NET and Linq currently requires an ORM.
Most ORMs allow you to drop down to SQL/ADO.NET when necessary for performance reasons.
How you choose to implement your data layer should completely depend on your requirements and the answer to that question is always situational. It's not possible to say ORMs are always superior to ADO.NET or vice versa.
IMO ORM is so good for a project which is not distributed. Sometimes your client use shared server or different database server that is even in the another country. In this case, I'm using SP. But ORM has another benefit. For instance, When you change the table structure, in SP, you've to change all of dependent SP. But in ORM, everything is ok after a few changes.
In what domains do each of these software architectures shine or fail?
Which key requirements would prompt you to choose one over the other?
Please assume that you have developers available who can do good object oriented code as well as good database development.
Also, please avoid holy wars :) all three technologies have pros and cons, I'm interested in where is most appropriate to use which.
Every one of these tools provides differing layers of abstraction, along with differing points to override behavior. These are architecture choices, and all architectural choices depend on trade-offs between technology, control, and organization, both of the application itself and the environment where it will be deployed.
If you're dealing with a culture where DBAs 'rule the roost', then a stored-procedure-based architecture will be easier to deploy. On the other hand, it can be very difficult to manage and version stored procedures.
Code generators shine when you use statically-typed languages, because you can catch errors at compile-time instead of at run-time.
ORMs are ideal for integration tools, where you may need to deal with different RDBMSes and schemas on an installation-to-installation basis. Change one map and your application goes from working with PeopleSoft on Oracle to working with Microsoft Dynamics on SQL Server.
I've seen applications where Generated Code is used to interface with Stored Procedures, because the stored procedures could be tweaked to get around limitations in the code generator.
Ultimately the only correct answer will depend upon the problem you're trying to solve and the environment where the solution needs to execute. Anything else is arguing the correct pronunciation of 'potato'.
I'll add my two cents:
Stored procedures
Can be easily optimized
Abstract fundamental business rules, enhancing data integrity
Provide a good security model (no need to grant read or write permissions to a front facing db user)
Shine when you have many applications accessing the same data
ORMs
Let you concentrate only on the domain and have a more "pure" object oriented approach to development
Shine when your application must be cross db compatible
Shine when your application is mostly driven by behaviour instead of data
Code Generators
Provide you similar benefits as ORMs, with higher maintenance costs, but with better customizability.
Are generally superior to ORMs in that ORMs tend to trade compile-time errors for runtime errors, which is generally to be avoided
I agree that there are pros and cons to everything and a lot depends on your architecture. That being said, I try to use ORM's where it makes sense. A lot of the functionality is already there and usually they help prevent SQL Injection (plus it helps avoid re-inventing the wheel).
Please see these other two posts on the topic (dynamic SQL vs
stored procedures vs ORM) for more information
Dynamic SQL vs. stored procedures
Which is better: Ad hoc queries, or stored procedures?
ORMs vs. stored procedures
Why is parameterized SQL generated by NHibernate just as fast as a stored procedure?
ORMs and code generators are kind of on one side of the field, and stored procedures are on another. Typically, it's easier to use ORMs and code generators in greenfield projects, because you can tailor your database schema to match the domain model you create. It's much more difficult to use them with legacy projects, because once software is written with a "data-first" mindset, it's difficult to wrap it with a domain model.
That being said, all three of the approaches have value. Stored procedures can be easier to optimize, but it can be tempting to put business logic in them that may be repeated in the application itself. ORMs work well if your schema matches the concept of the ORM, but can be difficult to customize if not. Code generators can be a nice middle ground, because they provide some of the benefits of an ORM but allow customization of the generated code -- however, if you get into the habit of altering the generated code, you then have two problems, because you will have to alter it each time you re-generate it.
There is no one true answer, but I tend more towards the ORM side because I believe it makes more sense to think with an object-first mindset.
Stored Procedures
Pros: Encapsulates data access code and is application-independent
Cons: Can be RDBMS-specific and increase development time
ORM
At least some ORMs allow mapping to stored procedures
Pros: Abstracts data access code and allows entity objects to be written in domain-specific way
Cons: Possible performance overhead and limited mapping capability
Code generation
Pros: Can be used to generate stored-proc based code or an ORM or a mix of both
Cons: Code generator layer may have to be maintained in addition to understanding generated code
You forgot a significant option that deserves a category of its own: a hybrid data mapping framework such as iBatis.
I have been pleased with iBatis because it lets your OO code remain OO in nature, and your database remain relational in nature, and solves the impedance mismatch by adding a third abstraction (the mapping layer between the objects and the relations) that is responsible for mapping the two, rather than trying to force fit one paradigm into the other.