I have just been working on a new project and doing things the same way I have for years now. However for the first time, I am constantly thinking about
scalability and performance of both the
application code and the
So in times past, I have been more than happy to
insert a new row, then grab the
last_insert_id and then translate this into an
object by calling the
getObjectById(id) method from within whichever persistence framework is in use. I find this is good practice because it will ensure that you are returning exactly what is stored in the database and any error will be picked up there and then, rather than next time you ask for the object.
The other way, since you have all the data required to build the object right in front of you, is to simply create the new object from the supplied data and simply set the
objectId once the statement is verified as complete. I have always felt as though there are still some unknowns which can occur, and if there are any
triggers in the database which transform the data in any way, then you will have a mismatch in state which is bad.
However, thinking purely about performance, I am obviously taking a hit by running multiple
queries to create the object (
select) which adds
overhead and I would like to make the application both as
secure as possible.
My question is, what would be the most appropriate approach for
security and then for the trade-off between the 3?