Subtitle: Object Relational Mappers are the New Standard Practice for Application Development
Okay – DBA’s are already upset after reading the title. I understand. Stored procedures have been the standard practice of most professional software developers for more than a decade. But like my recommendations on Flash, there are newer and better options than some old tried-and-true technologies.
I’ll have you know that I’m not an extremist on this subject. I have personally worked on many applications that use stored procedures, and I have written plenty of them myself to follow a client’s “established best practices.” Stored procedures still have a place in some scenarios. However, given a choice, I avoid stored procedures as often as possible.
Why Do Developers Use Stored Procedures?
Traditionally, there have been a lot of reasons given for the use of stored procedures. The most popular arguments include:
- Performance – The query plan for stored procedures is compiled in SQL Server so that subsequent requests can run faster. Also, a single stored procedure can perform multiple SQL commands, reducing traffic between an application and the database server.
- Security – Stored procedures are well defined database objects that can be locked down with security measures. Use of typed parameters can help prevent SQL injection attacks.
- Code Re-Use – Database queries can be written once and re-used multiple times without writing the same SQL commands over and over again.
- Business Logic Encapsulation – The database can house a lot of business logic so that the brain of your application is kept “neatly in one place.”
Ten years ago, I was completely on-board with this train of thought. But around 2005, I started working with Object Relational Mappers (ORMs) and it changed my whole thinking about stored procedures.
What is an Object Relational Mapper?
An ORM is a code-based tool for application developers to work with databases. The purpose of an ORM is to create a code representation of the data model. Once you have this code in place you can access your database without writing a line of SQL code. No stored procedures (or ad-hoc SQL) needed. A lengthy study is beyond the scope of this article, but you can read about ORMs on Wikipedia.
Oh CRUD
ORMs are very efficient at Create [INSERT], Read [SELECT], Update and Delete (CRUD) operations. Usually at least 90% of SQL commands used in an application are simple CRUD operations. ORMs automatically write parameterized queries for you so that you never have to spend time writing CRUD from scratch.
Writing stored procedures for simple operations is a waste of time and it muddies up the database. I cringe when I see a list of 500 stored procedures in a single database. I cringe further when I discover that most of the stored procedures contain mind-numbingly simple queries like “select * from [tablename] where [col1]=@param” and “update [tablename] set [col 1]=@param where [id]=@userId”.
It drives me batty when I know that someone took the time to write all of those stored procedures, then an application developer manually wrote code to call the stored procedure, convert and pass in parameters, check the result and pass back a DataSet. I commonly see ~20 lines of C# or VB application code to call a simple one-line stored procedure.
With LINQ, I can accomplish more functionality with less code. By writing “var result = context.TableName.Where(tn => tn.UserId == userId);” the data context writes a parameterized SQL query, the query is executed, the result is returned and translated into a strongly-typed set of objects (much better than a DataSet). I get more benefit out of one line of LINQ code than a stored procedure coupled with 20 lines of code to call it.
Good N-Tier Application Design
If you are familiar with n-tier (or multi-tier) application design, you know that the business layer belongs in the middle of your application stack. In other words, business logic should be compiled application code that is testable via automated unit tests.
Your data access layer should be comprised of an ORM and basic repository methodology. Some people would throw stored procedures into the diagram as a second data access layer, but this is unnecessary and (IMHO) incorrect.
A database should be limited to the role of a “persistence layer” – a technology agnostic storage mechanism. When business logic is scattered through stored procedures, database triggers and application code, the n-tier model is broken.
Since T-SQL is technology-specific, your stored procedures would need to be re-written in order to migrate to MySQL, Oracle or another database. If you avoid stored procedures and use an ORM like NHibernate, moving to a new database architecture is basically as simple as changing a connection string (okay, maybe not quite that simple in the real world).
Benefits of Object Relational Mappers
Every ORM is different, some with more benefits than others. My personal favorite is still PLINQ for LINQ-to-SQL, and there are versions for Entity Framework and NHibernate now.
These are the most common benefits to look for in a good ORM:
- Less Hand-Written Code – There is substantial time and cost savings when using a good ORM versus hand-writing stored procedures and stored procedure calls.
- Rapid Application Development – Developers are all under pressure to build more features with less time. Tools like PLINQO offer code generation with intelligent re-generation. This is extremely important because PLINQO can update your data layer to match the database with two clicks of a mouse. If you’ve been using stored procedures and your data model changes, you’re in for a lot of fun tracking down and fixing all of the references.
- Maintainability & Refactoring – The foundational principle of agile development is the expectation that applications will need to be changed in the future. The data model and business rules will change. If you use a good ORM, these changes can be handled quickly and easily with a refactoring tool (like ReSharper). Compiling your application is often enough to verify that your changes were done properly. But if you used stored procedures as the basis of your data access and/or business logic layer, you will be frightened to make any changes for fear of breaking something. This “stored procedure paralysis” leads to hacks and workarounds instead of properly addressing new requirements. I just saw this happen a few weeks ago on a client’s project.
- Performance – A LINQ data context uses deferred execution for selects, and it batches record updates and deletes in a single database round-trip on Submit(). Good ORMs offer additional performance enhancements like caching, futures and batch operations (select, update and delete). These can have a dramatic impact on application speed.
- Proper N-Tier Design – Your database should merely be a “persistence layer.” It should not contain the business logic of your application. Using an ORM helps you architect a solution where your business logic resides in strongly typed managed code (instead of being scattered through stored procedures and triggers). This keeps the separation of concerns more clear, avoiding a broken or inverted n-tier structure.
- Business Logic Encapsulation – The data entities that are generated by your ORM are effectively business objects. Instead of working with “dumb DataSets,” these entities can enforce business rules that can interact with your presentation layer and data layer.
Common Objections to Object Relational Mappers
- “Stored procedures are faster.” – In speed tests that I’ve seen, parameterized queries perform just as well as stored procedures (sometimes better). From what I’ve read, SQL Server does cache the execution plan of parameterized queries.
- “LINQ syntax is not as flexible as T-SQL.” – This is true but misleading. 95% of T-SQL queries I’ve seen can be accomplished easily in LINQ syntax (even aggregate functions). If you look at some sample LINQ commands you may be surprised what is possible. Also, you can execute custom SQL or call a stored procedure from LINQ and return the results in a strongly-typed object.
- “ORMs add too much overhead.” – Compared to what? If you’re comparing with straight ADO.NET and a DataReader, there is a slight performance hit. If you’re comparing with explicit hydration of custom business objects, there is likely a performance gain. Plus, good use of caching, futures and batch operations more than make up for any overhead. Remember that data access speed is not the only measure of good application design.
- “ORMs pull unnecessary data.” – By default most ORMs will return every column in the table(s) that you requested. However, most ORMs support projection queries where you can limit the columns returned. The results of your projection are returned into a strongly typed collection.
- “Stored procedures still provide better security.” – If you need to give data access to someone other than your development team, you should use a web service. As for SQL injection attacks, parameterized queries prevent this problem too.
- “ORMs should only be used to call stored procedures.” – Most ORMs can call stored procedures, so these two technologies are not mutually exclusive. However, calling stored procedures from an ORM negates many of the benefits of ORM technology and design patterns. It adds work and complexity while reducing benefits.
When Should I Use Stored Procedures?
I see several cases where stored procedures are still acceptable:
- You’re doing data warehousing / ETL / data aggregation. An ORM is usually not the right tool for this kind of bulk data management. You should consider a tool like SQL Server Integration Services (SSIS), BizTalk, or another dedicated ETL tool.
- You’re working on a legacy application where everything is already built using stored procedures. Sometimes you have to go with the flow. Sometimes adding a second tool is worse than supporting the wrong tool.
- You need to feed data to SQL Server Reporting Services (SSRS). Strangely, the CLR integration for SQL Server does not have LINQ support, so T-SQL is your only option with SSRS. But frankly, SSRS isn’t always the best choice either. There are a lot of good third party tools for report generation to HTML, PDF and Excel that can interface with your ORM. Since SSRS is not available in the Express Edition of SQL Server (and definitely not available in MySQL or Oracle) you are limiting your deployment options again.
- Your query absolutely cannot be performed with LINQ syntax. This is rare, but does happen occasionally. Thankfully, stored procedures or custom SQL can be called from a LINQ data context.
- You need to perform a lot of complex SQL statements from a small set of input. Although there are lots of ways to handle batch operations with PLINQO, sometimes “you gotta do what you gotta do” to address a performance issue.
- You need to push thousands of records to SQL in a single statement. This is most efficient through table-valued stored procedure parameters in SQL Server.
I hope you find this information useful. Happy coding!
 |
![[Digg]](/wp-content/mu-plugins/post-flair/sharing/images/digg.png){kind=small} |
![[del.icio.us]](http://images.del.icio.us/static/img/delicious.small.gif){kind=small} |
Filed under: Patterns & Practices | Tagged: Entity Framework, LINQ, LINQ-to-SQL, NHibernate, Object Relational Mapper, Object Relational Mappers, ORM, ORMs, PLINQO, SSRS, Stored Procedure, Stored Procedures | 16 Comments »
![[Digg]](http://cdn1.diggstatic.com/img/favicon.a015f25c.ico){kind=small}
