Should I use stored procedures or inline SQL queries in my application code

Data and Databases
1

I’m working on a C# web application project with my teammate, and we can’t decide on the best database approach. Right now, we’re using inline SQL queries written directly in our C# code to talk to our SQL Server database.

Benefits of inline SQL in code:

  • No need to deploy database scripts when updating queries
  • Much simpler to switch to a different database later

Benefits of stored procedures:

  • Better performance from what I’ve heard
  • More secure against SQL injection attacks

Which approach would you recommend for a medium-sized web forum application? Are there other important factors I should consider when making this decision?

2

honestly depends on ur team’s sql server experience. if you’re not super experienced, stick with inline queries using parameterized statements - they’re safer. less chance you’ll mess up permissions and way easier to debug when stuff breaks. stored procedures aren’t automatically more secure if you’re already parameterizing correctly.

3

interesting debate! what kind of traffic are you expecting? i’m curious which way your teammate’s leaning on this. have you looked into an ORM like entity framework? could be a good middle ground between raw SQL and stored procedures.