IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
- The sequence of the specified selection conditions is of great importance
for restrictive database queries (WHERE clause). The WHERE clause
should be formulated so that the first condition selects the smallest possible
result set, whilst the last condition selects the largest result set. This
optimises the performance of the database system through an efficient
arrangement of the selection conditions, which notably accelerates search
operations. The same applies to database queries formulated for several
tables (so-called joins).
It must be noted here that database management systems often optimise
database queries automatically. In fact, many database management
systems offer several optimisation strategies which can be selected via
various parameters. If a database management system does make use of
such Optimisers however, it might be possible that carefully formulated
database queries are internally not processed as expected.
In this respect, some database management systems allow the processing of
database queries to be monitored (e.g. with EXPLAIN in Oracle or
SETOEP in Ingres). It is also possible to use HINTS to explicitly define the
processing of database queries, thus eliminating the need for optimisers.
However, this option should only be used when absolutely necessary.
The optimisers supported by a database management system as well as
their advantages and disadvantages are usually documented in the manuals
accompanying the system. If several optimisers are available, the
administrator should be requested to specify a suitable one for use.
- In the case of Joins, it must also be noted that fields are allocated uniquely
to tables.
Example:
TabA: ID NUMBER(4)
Manufacturer# NUMBER(6)
TabB: ID NUMBER(4)
Article# NUMBER(10)
Price NUMBER(10,2)
Designation VARCHAR(30)
SELECT TabA.ID, TabB.Designation, TabB.Price
FROM TabA, TabB
WHERE TabA.ID=TabB.ID
The "ID" field is present in both tables and must therefore be specified
explicitly together with the corresponding table name in the database
query. Otherwise the uniqueness of the selection is no longer ensured, and
the database query is aborted with the issue of a corresponding error
message.
All other fields can be allocated uniquely in this case. SQL does not require
an explicit specification of the related table name for each field.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000