Re: Opinions on approach, please...



"Robert" <no@xxxxxx> wrote in message
news:l80o34ttp1n7q9bch9na06r6f3h45s020d@xxxxxxxxxx
On Tue, 27 May 2008 23:29:35 +1200, "Pete Dashwood"
<dashwood@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:

"Robert" <no@xxxxxx> wrote in message
news:dbrm34h6fnvtl296cbteg5d6j76e3cl3a0@xxxxxxxxxx
On Tue, 27 May 2008 11:45:57 +1200, "Pete Dashwood"
<dashwood@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:



"Robert" <no@xxxxxx> wrote in message
news:5nvl34pdmegh0jld4fnl3t0e80phj5k5an@xxxxxxxxxx
On Tue, 27 May 2008 01:47:26 +1200, "Pete Dashwood"
<dashwood@xxxxxxxxxxxxxxxxxxxxxxxxx>
wrote:

I can detect which key field is being used, I can detect the relation,
I
can
get the data for the condition, and I can probably handle up to 3
connected
conditions, but I still don't havea clear idea of how I'll get this
into
MOST... :-)

Write the where clause manually, one time.

Do you mean in the Application?

In the data layer. Create a data layer program per table, containing all
the SQL for that
table.

That is exactly what I'm doing. It cannot contain manually written WHERE
clauses because these are application dependent. I am looking for it to
have
a GENERAL WHERE clause structure which it can populate with data from the
interface and EXECUTE. It is tricky, but I don't think it is impossible.
There may have been some misunderstanding here.

It's not that simple. The statement will say

EXECUTE :handle USING :host-variable1, host-variable2, ...

The number of host variable pointers, which is fixed at compilation time,
must equal the
number of bind variable tokens in your dynamic SQL.

Suppose I PREPARE a statement that references 1 or more Host variables and
then simply EXECUTE that without passing it any parameters?

Example:

instead of: PREPAREing a parameterized statement like:

SELECT CustName FROM Customers WHERE CustID = ?

....and executing it as: EXECUTE handle USING "10001"

I was to say:

SELECT CustName FROM Customers WHERE CustID = :HVCustID

....then...

Move "10001" to HVCustID
EXECUTE handle

Can I do that? (I know I could set it up and try it, but I'm hoping to save
some time and also get your opinion on the approach taken.)

If I can legally do this and PREPARE late binds my statement I wouldn't need
to worry about parameter lists at all.




That's why I recommended doing it once to see what's involved.


I'm still building infrastructure, but I will do this as you suggest, when I
get to the nitty-gritty.

There IS a way to modify the bind variable list at execution time. It is
the DESCRIBE
verb, which is in guru territory. Your frustration trigger will be pulled
when you
discover DESCRIBE changes the number of arguments and their names, but not
their types.
You'll wind up converting everything to and from strings (varchars) or
much worse,
enbedding data in the SQL 'just to get it working'.

I'll try and avoid that and keep my statements simple.

The practical solution is a separate entry point (method) for each SQL
statement.
Usually, the only difference is the hard coded WHERE clause.


Interesting. Thanks.

Yes, the layer itself has to be written in COBOL, but it will be a COM
server. As such it can be activated from ANY language. It would be
embedded
in application COBOL if I allowed SQL in the application programs.

That's why I don't want SQL in the application code. Just an invocation of
the COM component.

That's the classical three layer client/server model.

Yes. I have been advocating and using it for nearly two decades now... :-)

Don't assume the data layer must execute on the same machine as the
application. It is
semi-common for the invocation to send a message through middleware.

I don't make assumptions and I have designed and developed distributed
applications. I was using distributed COM+ when everyone was saying how
vulnerable it was and how it could never work. It worked fine and we were
never hacked. (Since then, things have moved on and .NET is the way to go
for Win Users, now. This current exercise is a step in that direction.



The where clause on UPDATEs is simple if you get in the habit of always
fetching a ROWID.
It's faster too. Same for IN followed by a subselect.

Is ROWID a feature of the RDBMS or is it a column you have defined? Not
familiar with this.

It's a database feature. ROWID is your friend.

Thanks. I've never used it but will check it out and do so.

Have you ever tried putting host variables into dynamic SQL?
No, I don't think so. I have limited experience with dynamic SQL in
general,
but I am learning rapidly... :-)


If not, do it once to see
what's involved before you go down that road. It's a pain and it is
error-prone.

I'll take your word for it. What alternative would you propose?

Hard code WHERE clauses.

I'm coming to the conclusion that that won't be an option, but I haven't
decided yet. Until I actually get to coding it and trying it, I'll keep an
open mind.

I'm still not clear on where this hard code would be and how it would work.
You say in the data layer, but I don't see how I can hard code clauses that
I don't know about until run time. I don't like this scenario and I don't
want to have to manually amend every MOST component before I run an
application against it. I may have misunderstood what you're suggesting or
you may not understand the approach I am taking. Either way, I can't
manually amend MOST.

Convert the ISAM IO to data
layer SQL, then manually tailor where clauses.

If I do that I'd need to tailor manually every single COM server, and
change
it manually for every application program that uses that particular ISAM
file, before inserting invokes into that particular application. There
has
to be a better way. If the COM server is generalised to handle whatever
the
application program requires, then I don't need to do that. The only part
that is problematic, is the conditions on things like singletons and
START.
SQL provides the capability to build a query at run time and execute it. I
believe the application can pass enough information through the interface
to
allow the COM server to do that.

If you go with dynamic SQL, you'd better master SQL debugging tools,
because you'll be
spending a lot of time using them. A handy one that's often overlooked is
ODBC tracing.

Yes, I have used ODBC tracing. It is a good tool, especially when the ODBC
driver is dodgy... :-) I spent a couple of days tracing SQL once and then
found the ODBC driver needed an update. Did it and everything worked fine...
:-)

Thanks for your post, Robert.

Pete.
--
"I used to write COBOL...now I can do anything."


.

Relevant Pages

  • Re: Opinions on approach, please...
    ... Create a data layer program per table, ... number of bind variable tokens in your dynamic SQL. ... then simply EXECUTE that without passing it any parameters? ... explicitly code dummy words as bind variable placekeepers, put the host variables on the ...
    (comp.lang.cobol)
  • Re: Opinions on approach, please...
    ... Create a data layer program per table, ... number of bind variable tokens in your dynamic SQL. ... then simply EXECUTE that without passing it any parameters? ... Hard code WHERE clauses. ...
    (comp.lang.cobol)
  • Re: Opinions on approach, please...
    ... Write the where clause manually, ... In the data layer. ... I worked at one place that had all the SQL in the database. ... one to get the SQL and a second to execute it. ...
    (comp.lang.cobol)
  • Re: Access and GUID Column Type
    ... > clauses in the SQL's are exactly the same. ... Perhaps you could assign the SQL statement to ... - execute the statement that is returned by the Debug.WriteLinein Query ...
    (microsoft.public.dotnet.languages.vb)
  • Re: SQL Injection- Bypassing magic_quotes
    ... Because i was trying to execute: ... Don't terminate the query and you most ... Or try something like bobcat or one of the other SQL injection tools out ... Chief Information Security Officer ...
    (Pen-Test)