Backend Queries

SQL injection is prevented by using parameterized statements instead of string concatenation. Parameterized queries separate SQL logic from user input, ensuring malicious code cannot alter query execution. This applies across SQL, ORM query builders, and raw queries in repository, DAO, and service layers.

N+1 query problems occur when fetching related data triggers additional queries for each record, multiplying database calls. Fix this by using eager loading—loading related data in a single query—rather than lazy loading each association individually.

Query performance improves through proper indexing on frequently queried columns, selective column fetching instead of SELECT *, eager loading to avoid N+1 issues, and query timeouts to prevent runaway operations. These practices reduce latency and database load.

Transactions wrap multiple database operations, ensuring all succeed or all fail together. This maintains data consistency—preventing partial updates if an error occurs mid-operation—and is essential for reliable INSERT, UPDATE, DELETE, and complex workflows involving joins and aggregations.

Yes, parameterized queries work across SQL, ORM query builders, and raw queries. ORMs typically abstract parameterization automatically, but understanding the underlying mechanism ensures secure and optimized queries regardless of your data access layer.

Lazy loading defers fetching related data until accessed, causing N+1 problems at scale. Eager loading retrieves related data upfront in a single query, reducing total database calls and improving performance for operations involving joins and complex associations.