The SQL controversy and Sue's Book

[Gregg Bolinger]

Reading a review of Sue's book, the reviewer made this statement:
The chapter on the SQL tags, the most controversial library, included her opinions on why you would use them.
I was wondering what the controversy surrounding these tags are.

[Pradeep bhatt]

It is not suggested to use SQL in the JSP page. I guess it is the controversy .

[Gregg Bolinger]

Well, about the only time I can see using SQL in a JSP file is when you need to populate a list of some sort like a Select List.
Can anyone elaborate a bit more on the controversy or is that pretty much it?

[Bear Bibeault]

Performing SQL directly from a JSP page, which constitutes a 'view', is a pretty severe violation of the MVC architecture. Hence the controversy.
I could go into the catechism of why uncoupling the model from the view is a good thing and all, but that's been covered before and by others more eloquent than myself.
I'll just say that I'm a very strong proponent of keeping the layers separate, having been burned many times in the past when such layering was ditched in the interest of 'engineering expediency'.
bear
[ September 30, 2003: Message edited by: Bear Bibeault ]

[Gregg Bolinger]

engineering expediency.
Good term...
Thanks Bear.

[Sue Spielman]

The SQL actions provide access to such things as making database queries, accessing query results, performing database modifications, and doing transactions. While these are useful features, they are features that break the MVC model when used from a JSP. These actions might serve a valid purpose in prototyping and/or very simple applications, however I'm against the use of them in production applications. If you are planning on using these actions it is wise to become familiar with such patterns as Transfer Objects, DTO Factory, Data Transfer Hashmaps, etc.
Sue

[Bear Bibeault]

however I'm against the use of them in production applications.

Oh, I like her so much!
bear

[Gregg Bolinger]

Originally posted by Bear Bibeault:

Oh, I like her so much!
bear

[Ko Ko Naing]

For simple applications, we actually do not need to worry about MVC. Since the MVC itself can make the simple applications complicated... So let's confidently use it in simple applications...

[Pradeep bhatt]

I would never use the SQL JSP tags.

[Bear Bibeault]

So let's confidently use it in simple applications...

The problem with so-called "simple applications", as well as "prototypes", is that they all-too-often take on a life of their own and turn into big applications and "real" programs. So one must be cautious about the "oh, it's only a small app so I can cut corners" attitude. It can often bite you in the derriere.
I've got the scars,
bear

[Gregg Bolinger]

Originally posted by Bear Bibeault:

The problem with so-called "simple applications", as well as "prototypes", is that they all-too-often take on a life of their own and turn into big applications and "real" programs.

As mine has started to do..

[Ko Ko Naing]

Originally posted by Bear Bibeault:

The problem with so-called "simple applications", as well as "prototypes", is that they all-too-often take on a life of their own and turn into big applications and "real" programs. So one must be cautious about the "oh, it's only a small app so I can cut corners" attitude. It can often bite you in the derriere.
I've got the scars,
bear

I think it depends on the personal perspective whether a particular application is simple or not...

[Vedhas Pitkar]

Originally posted by Pradeep Bhat:
I would never use the SQL JSP tags.

Never?Maybe sometimes there is a need of showing dynamic drop downs, then what do you do?I dont know what the 'SQL Tags' do but I think in some cases like the one above ,SQL has to embedded in JSP.

[Bear Bibeault]

SQL has to embedded in JSP.

Has to? Nay.
I routinely populate dropdowns with values that come from a database, but you can't even smell the SQL necessary to do so from the JSP page. Rather the values are abstracted by a delegate class (you could call it a bean) which in turn uses a well-defined API to the model layer which is what performs the SQL.
Just because you need dynamic data to appear on the pages, doesn't mean that the pages have to access the database directly.
bear

[Jeroen Wenting]

Originally posted by Bear Bibeault:

The problem with so-called "simple applications", as well as "prototypes", is that they all-too-often take on a life of their own and turn into big applications and "real" programs. So one must be cautious about the "oh, it's only a small app so I can cut corners" attitude. It can often bite you in the derriere.
I've got the scars,
bear

Like the proof of concept I used to work on 5 years after the project it was a proof of concept for was cancelled...
The proof of concept had been taken into production at a major company instead of the cancelled application.
(the proof of concept had over time grown to be over some 100MB sourcecode, about half of it generated (yugh)).
[ October 02, 2003: Message edited by: Jeroen Wenting ]

[Pradeep bhatt]

The problem with so-called "simple applications", as well as "prototypes", is that they all-too-often take on a life of their own and turn into big applications and "real" programs.

I am surprised by this one. The life time of POC is very small. Bear, may I please from where did get the above info?

[Ko Ko Naing]

Originally posted by Pradeep Bhat:

I am surprised by this one. The life time of POC is very small. Bear, may I please from where did get the above info?

I also would like to know from where Bear got that info...

[Rafael Lee]

I am beginning to understand the MVC concept and I think I'm also in favor of the layering or sepration of code to implement MVC functionalities.
So what were those designers of jsp/jstl thinking when they allowed SQL to be performed in JSPs? I hope those official designers/experts also come out and enlighten us.
The SQL controversy seems to be like a fruit dangling up the tree with the keeper telling kids not to take it. Just watch it. Or, just know it is there. But not take it.

[Ko Ko Naing]

Originally posted by Rafael Lee:
I am beginning to understand the MVC concept and I think I'm also in favor of the layering or sepration of code to implement MVC functionalities.
So what were those designers of jsp/jstl thinking when they allowed SQL to be performed in JSPs? I hope those official designers/experts also come out and enlighten us.
The SQL controversy seems to be like a fruit dangling up the tree with the keeper telling kids not to take it. Just watch it. Or, just know it is there. But not take it.

I agree with you, Rafael... People are afraid that they did something that Adams did in the Garden of Eden.... Some people like Eve have eaten those fruits... But people like Adams are hestitating to eat it...
Hope this example is in the same scenerio with SQL controversy case...

[Jeroen Wenting]

Some actual code to create a dymanic dropdown using custom tags (in this case a custom tagset I wrote myself inspired by some examples).

<font size="2">
<select class="select" name="sel_1">
  <ed:TableIterator resultId="c7list">
   <option value="<ed:getColumn column="idx"/>"<ed:getColumn column="sel"/>>
     <ed:getColumn column="code"/>
   </option>
</ed:TableIterator>
</font>

c7list is an List set into the pageContext (read, session (most of the time)) at some point which contains a Map with fields 'idx', 'sel' and 'code'.
I've made it quite simple, putting 'selected' or an empty String into 'sel' to indicate the default value for the list.
For different dropdowns, simply make different Lists in your pageContext (I've written a simple testtag that puts List filled with dummy values in there for example, but normally do it in a bean or servlet that delegates rendering to the JSP).
The same code can be used to render HTML tables, groups of radiobuttons or checkboxes, basically anything that iterates over a set of data.
They can even be nested:

<font size="2">
<% int k=1; %>
<ed:TableIterator resultId="memos">
 <tr class="zebra">
  <td style="vertical-align:top;">
   <input type="hidden" value="<ed:getColumn column="idx"/>"/>
   <select name="omscode_<%= k %>" class="select">
     <ed:TableIterator resultId="codelist">
<option value="<ed:getColumn column="idxnum"/>" 
<ed:getColumn column="<%= Integer.toString(k) %>"/>><ed:getColumn column="code"/></option>
     </ed:TableIterator>
   </select>
  </td>
  <td>
   <textarea name="memo" cols="50" rows="4"><ed:getColumn column="memotext"/></textarea>
  </td>
</tr>
<% k++; %>
</ed:TableIterator>
</font>

Here I add a field with a numeric key for each row in the parent table which is used to indicate which corresponding rows in the childtable are to be selected.
[ October 02, 2003: Message edited by: Thomas Paul ]

[Thomas Paul]

Originally posted by Ko Naing:
For simple applications, we actually do not need to worry about MVC. Since the MVC itself can make the simple applications complicated... So let's confidently use it in simple applications...

If I was your boss you would be so fired!
[ October 02, 2003: Message edited by: Thomas Paul ]

[Pradeep bhatt]

Originally posted by Thomas Paul:

If I was your boss you would be so fired!
[ October 02, 2003: Message edited by: Thomas Paul ]

I am strong proponent of MVC..it is must for any applications

[Bear Bibeault]

I also would like to know from where Bear got that info...

The proverbial School of Hard Knocks, boys. I've been in this industry for 24 years and trust me, that little POC program you wrote can turn into a monster that will eat you whole. Middle management loves momentum and no matter how much you tell that it's time to stop and refactor to a reasonable architecture, they won't let you.*
bear
* My present job is a refreshing exception. I was hired specifically to rearchitect a massive web application that the they realized needed help.

[Bear Bibeault]

If I was your boss you would be so fired!

And if Thomas didn't fire you, I would!
bear

[Jason Menard]

Originally posted by Rafael Lee:
So what were those designers of jsp/jstl thinking when they allowed SQL to be performed in JSPs? I hope those official designers/experts also come out and enlighten us.

I believe they were thinking of MS ASP, where it is/was quite common to have page-centric "architectures" with database access embedded into the page.

[Gregg Bolinger]

Originally posted by Jason Menard:

I believe they were thinking of MS ASP, where it is/was quite common to have page-centric "architectures" with database access embedded into the page.

Ok, so now the crappy part is in order for the JSTL to be backwards compatible they have to leave that in there and allow other people to make huge mistakes.
Kind of like allowing scriplets in JSP's. But that is another debate...

[Eric Sexton]

Are there security implications for having data access statements (sql) in the JSPs? Could a hacker use that info to his advantage?

[Gregg Bolinger]

Originally posted by Eric Sexton:
Are there security implications for having data access statements (sql) in the JSPs? Could a hacker use that info to his advantage?

I don't think so. By the time it gets to your browser, it's all HTML anyway. If they could get to the JSP's, they could get to things a lot worse.

[Ko Ko Naing]

Originally posted by Thomas Paul:

If I was your boss you would be so fired!
[ October 02, 2003: Message edited by: Thomas Paul ]

Oh...
So u guys r going to dump the Value Object, Data Access Object, Business Delegate and Front Controller...
I don't think MVC is suitable for all cases... Otherwise, what's the point for creating other design patterns???
Maybe u guys r familiar only with MVC and think that it is the best...

[Ko Ko Naing]

Originally posted by Eric Sexton:
Are there security implications for having data access statements (sql) in the JSPs? Could a hacker use that info to his advantage?[/QUOTE
Compiled JSPs are hidden from the user's browsers and keep in mind that surely java is famous for security issues...

[Bear Bibeault]

Maybe u guys r familiar only with MVC and think that it is the best...

I'm not sure who the "u guys" are -- maybe a new rock band? -- but I'll address the question in any case.
Am I familiar with more patterns than MVC? Of course. Are there other patterns that could be properly applied to applications, especially web applications? Sure. Do I feel that the MVC approximation known as "Model 2" is the best* pattern available for web applications? Yes, I do believe this. Is there room for alternate opinions? You bet.
However, I can't see the "it's only a simple application so we can just throw caution to the wind" approach as a valid design pattern.
bear
* My definition of "best" not only encompasses the applicability of the pattern to the purpose, but also the body of experience, knowledge, support and tools available in the community.

[Gregg Bolinger]

Originally posted by Bear Bibeault:

I'm not sure who the "u guys" are -- maybe a new rock band? -- but I'll address the question in any case.
Am I familiar with more patterns than MVC? Of course. Are there other patterns that could be properly applied to applications, especially web applications? Sure. Do I feel that the MVC approximation known as "Model 2" is the best* pattern available for web applications? Yes, I do believe this. Is there room for alternate opinions? You bet.
However, I can't see the "it's only a simple application so we can just throw caution to the wind" approach as a valid design pattern.
bear
* My definition of "best" not only encompasses the applicability of the pattern to the purpose, but also the body of experience, knowledge, support and tools available in the community.

Good response Bear. I agree with you 100% on However, I can't see the "it's only a simple application so we can just throw caution to the wind" approach as a valid design pattern.
FYI - I converted my J2EE app to STRUTS this week. And yes, I know how you feel about STRUTS.

[Ko Ko Naing]

Originally posted by Bear Bibeault:

I'm not sure who the "u guys" are -- maybe a new rock band? -- but I'll address the question in any case.
Am I familiar with more patterns than MVC? Of course. Are there other patterns that could be properly applied to applications, especially web applications? Sure. Do I feel that the MVC approximation known as "Model 2" is the best* pattern available for web applications? Yes, I do believe this. Is there room for alternate opinions? You bet.
However, I can't see the "it's only a simple application so we can just throw caution to the wind" approach as a valid design pattern.
bear
* My definition of "best" not only encompasses the applicability of the pattern to the purpose, but also the body of experience, knowledge, support and tools available in the community.

Well, well, well... U got 24 years of experience and know everything about design patterns...
Then all Javaranchers, let worship Bear Bibeault as a "God of Gods in Design Patterns"...
Praise "Bear Bibeault", Almighty God of Design Patterns...

[Gregg Bolinger]

Originally posted by Ko Naing:

Well, well, well... U got 24 years of experience and know everything about design patterns...
Then all Javaranchers, let worship Bear Bibeault as a "God of Gods in Design Patterns"...
Praise "Bear Bibeault", Almighty God of Design Patterns...

Hmm, I didn't get that from Bear's response. What I got was Bear's opinion is that MVC is the best approach for Web Applications. Key word here, opinion. And yes, Bear does have 24 years experience. That usually accounts for something.
So let's try and not let this thread go in a direction we all know and hate.

[Bear Bibeault]

As Gregg pointed out, yes I stated my opinion which I will stand by and feel that I can more-than-adequately back up with the scars that I have accrued during my experiences.
You are free to agree or disagree.
What you are not free to do is to start personal attacks which your most recent post flirts quite closely with. But I've got a thick skin to go with those scars.
Now let's get this thread back on the "be nice" track.
bear

[Ko Ko Naing]

Originally posted by Bear Bibeault:

And if Thomas didn't fire you, I would!
bear

I am willing to be nice on the thread... But can I assume the above message as some kind of insulting on personal ability? Actually, I am just a programmer with surely not as much as 24 years...
I am here to share some knowledge to others as well as from them... Therefore it's good to be nice with people and pay respect on the personal ability...
So let's pay respect each other... No more insulting...
God bless you all...

[Jason Menard]

Originally posted by Ko Naing:
But can I assume the above message as some kind of insulting on personal ability?

I wouldn't assume that. I interpret it as "I would fire you for producing a substandard product and ignoring commonly held software engineering best practices". In the software business, a substandard product would include one that is poorly coded using ill-advised software principles and practices. In my book, a page-centric web application that placed most of the code in JSPs, disposing of commonly accepted best-practices and making maintenance a nightmare, would certainly qualify as a substandard product.

[Gregg Bolinger]

Originally posted by Jason Menard:

I wouldn't assume that. I interpret it as "I would fire you for producing a substandard product and ignoring commonly held software engineering best practices".

Not to mention the fact that he was joking. It takes some time around here, but eventually you get a feel for everyone's humor. It is especially difficult to pick up because all our corrospondence is entirely text based. So we can't hear each other's tone of voice or see facial expressions.
Ko, if you were joking around with Bear with your earlier comment, then I will apologize for everyone's comments in regards to that. However, at 62 posts (since June of last year no less) we just don't know your style of humor yet. So it is best if you amend such comments with things like "Just kidding" or "Gotcha" or something to give us a clue as to how you operate.

[Ko Ko Naing]

I think the hot wave has already calmed down... Make Love, No War...