Let me illustrate this question with a simplified example. Suppose I am building a project using python with a PostgreSQL relational database. In my database, I have two tables: "parent" and "child", which are N through M linked through the table "parent_child". I want to be able to get some data about a particular child item belonging to a specific parent in a safe way that allows me to make the following request (X, Y and Z are literals provided by the user):
SELECT child.age FROM parent, parent_child, child WHERE child.id = parent_child.child_id AND parent_child.id = X AND parent_child.parent_id = parent.id AND parent.id = Y AND parent.password = Z;
Say that the user comes in and enters the wrong value for X, Y or Z, the query returns an empty set that can be detected, and a message that tells the user that an error has occurred. The problem, of course, is that I cannot determine what value causes the problems, and therefore cannot provide the user with specific information about what they entered incorrectly?
The simplest solution is to split the request into several parts. First check if parent.id exists.
SELECT parent.id FROM parent WHERE parent.id = Y;
Secondly, check the password is correct.
SELECT parent.id FROM parent WHERE parent.id = Y and parent.password = Z;
Third, check if the child exists.
SELECT child.id FROM child WHERE child.id = X;
Fourthly, checking that the child element belongs to the parent object and returns the information we need.
SELECT child.age FROM child, parent_child WHERE parent_child.child_id = child.id AND parent_child.parent_id = Y AND parent_child.child_id = X;
These four queries will allow us to check specific things about the information provided by the user and report specific problems as they arise. Obviously, the four queries have some additional overhead per request, and I find the four queries less readable than one. Anyway, to have the best of both worlds? One request and detailed error messages?