The following general rule applies when manipulating data in databases:
- Can it be done with SQL? Do it with SQL.
- Can it be done with PLSQL? Do it with PLSQL.
- Do it with the programming language of your choice, it will be slow anyways.
Why is it bad to do it in Java?
To be able to do something like sorting within Java you obviously first have to get the data from the database into your program space and afterwards you need to write it back. This is an obvious overhead that is way too often ignored, and especially becomes difficult, if you work with huge amounts of data. Just think about how long it takes to pull out 2 GB from a database - worst case - over a network connection and then even send the result back.
If you go the SQL/PLSQL way, all data stays in the database and never needs to be forwarded to your program. This not only removes the overhead of transfer, but as well allows the database to handle this in the most optimized form - another overhead that is often ignored. If you pull out data, the DB doesn't know what you are going to do with it, so it just has to hand over everything to your code. If you do something like a sort on one table, the DB i.E. knows that sub-tables and links are not affected anyways, so there is no need to even read that data. Yet again a noticeable performance gain.
Just think about what might be faster: your code that you wrote in 5 minutes, or the DB code that hundreds of people wrote in over 10 years, trying to squeeze out even the last bit of performance possible?
In addition if you read data from a database, it will be transfered to you in an insecure way. So if someone does a man-in-the-middle attack while you look through a user's passwords, that man in the middle now knows those passwords as well. Or the other way round: if your program has a bug that can be exploited to gain access to the user's critical data, this is a security issue. If your code never has that ability in the first place, because all that data is handled internally by the database, then there is nothing that can even be a security issue in your code.
20,000objects is rather small.