Post by Lawrence D'OliveiroPost by billPost by Simon ClubleyIf you want to write business applications, then either Java or a
subset of C++. C++ subset to be chosen based on programmer skillsets
and the problem to be solved.
Or COBOL which was actually designed for the task.
Supposedly. But a couple of decades after the COBOL spec was first
published, these things called “relational databases” appeared on the
scene, and they soon became essential for “business applications”. And the
best way to access them turned out to require generating SQL query
strings. But good string handling had not been considered a necessity for
“business applications” in COBOL. So it had to resort to nonstandard
kludges tacked to the side to cope with SQL queries.
Well, that is written by someone without a clue.
Building SQL queries using string operations is a no-no
for any professional database development. It does mean that
the whole SQL syntax check and compilation has to be done by
the run time environment. And if some parameter changes (like
an order number), the whole query is concidered to be "new" and
the full syntax check and compilation is done again each time.
In VMS, and using Rdb, this is called "Dynamic SQL" and is never
used for VMS based applications. There is a network interface
(SQL/Services) that receives dynamic SQL statements (usually)
comming from PC sources over some ODBC link. But other client
API libraries exist, even one native for VMS.
For applications developed on, and running on, VMS there are two
main options:
Embedded SQL.
Supported by most common languages. When building an application here,
a pre-compiler is first run. That one extracts all SQL statements and
compiles the SQL into object/machine code. When the main compiler is
then run, this object code is automaticaly included in the main object
file.
SQL Modular Language.
This is a bit similar to Embedded SQL, but the SQL code is kept in
a separate file by itself. And the SQLMOD compiler only reads this
file and creates a stand-alone object file. This object file is then
just included in the build of the main application. The main application
just calls some functions with any name (like "GetOrder") and it
(the main code) has no idea that there is any SQL or database or how
that order data is fetched. So it can be used from any compiled language
no matter if that specific language have any specific SQL support.
For Cobol both these options exists. They can be mixed anyway in the same
application, if needed. We had some common queries (like "FetchOrder") as
SQLMOD files and then added the specific application queries into the
application code as Embedded SQL for easier maintenance of the code.
So, the bottom line is, that there is absolutely no need for any
string operations to use SQL from Cobol applications.
And, as Arne also mentioned, there is a huge security issue with
bulding SQL queries using string operations, if you include any
dynamic parameters into that.
If you need to use dynamically built SQL queries, at least use what
is commonly called "parameter markers", where the main SQL code and
the values of any parameters are separated from each other. That way
you cannot include any non-wanted SQL code in the actual values of
the paramaters.
Jan-Erik.