Re: Spring/hibernate and JDBC
On 7/11/2011 10:19 AM, Gunter Herrmann wrote:
markspace wrote:
Still good to know what JDBC is and does, since it's used by JPA and
Hibernate (et al.).
If you want to create complex database centered applications and
want decent security you would create an API in the database
without any direct access to tables for the application.
Very often you have different applications running the same
type of tasks even based on different programming languages.
Just imagine a hotel reservation system (single property).
You have the following apps creating/updating reservations:
1. The local property management system
2. The chain's central reservation system
3-10. 3rd party reservation systems (for travel agent reservations)
11. Hotel's web site
12. Chain's web site
13-20. Other web sites doing reservations for you.
If you use a capable DB (such as Oracle) you do everything via
packaged stored procedures and (pipelined or not) table functions.
You cannot trust any outside application, so do the same for
your own stuff.
If you want to expose the same let us call it low level business
logic to multiple apps in different technologies, then moving
that logic to an SP layer in the DB tier is one way of doing it.
The con is that a divorce from your database vendor becomes
extremely costly.
A modern alternative solution to the same problem is to have the
different apps use the same (web) services.
This approach additionally prevents any SQL injection.
No it does not.
SQL injection can potentially also happen with SP's.
In reality it never happens, because when people know how
to use SP's they also know how to avoid SQL injection.
But then they would also know how to avoid it in Hibernate,
plain JDBC etc..
In this case Hibernate is pretty useless (just an additional layer
of framework heavily using reflections making debugging more
complicated than necessary.
It avoids the database dependency.
It gives a good OO view of data.
It is trivial to get it to output the actual SQL it executes.
Definitely not useless in general.
Arne