0

Currently, I only use stored procedures, is this considered good practice or bad? I find it helpful to separate my SQL code from my PHP code, and I also remember hearing in a PHP course I took a few semesters back that stored procedures are more secure.

Improve this question

1 Answer 1

Reset to default
4

In the past, stored procedures and prepared statements were always faster than dynamic SQL strings sent to a database. These days, although that might still be the case sometimes, the differences are minor, if not negligible, so the major benefits of a stored procedure are safety from SQL injection attacks, and also as a layer of abstraction between the application code and the database (allowing you to use the same queries easily across different DB APIs or even different languages). So in general I'd still prefer stored procedures where possible.

Improve this answer
Sign up to request clarification or add additional context in comments.

2 Comments

Sending parameters to a stored procedure is less data over the wire than the entire SQL statement, making using stored procedures faster. Stored procedures can also contain multiple statements, which would mean trips back & forth from the application to the database - again, stored procedures have the edge because time over the wire and processing in app before passing back is overhead you can't recoup.
Awesome, I currently have a function that allows me to build a CALL statement for stored procedures. The function takes in the name of a procedure as well as an array filled with the data being processed and then it does the magic. It's very simple and helpful, I'm glad I don't have to get rid of it!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.