* "George Koras" <gkoras@cres.gr> wrote:
|
| Yes, I agree that it certainly has to be done before SQL is sent to the
| driver, i.e. in the middle tier!
| Is it a performance bottleneck? Would PreparedStatement be more efficient?
|
Depends on your application, but doing escaping on all queries would
certainly increase the overhead for some queries.
With PreparedStatement you only escape the part of the query that is string
input, so, yes, it would be more efficient.
--
Gunnar Rønning - gunnar@polygnosis.com
Senior Consultant, Polygnosis AS, http://www.polygnosis.com/