I've always wondered what the difference is between these three ways of using COUNTSQL (I also don't know if there is a difference depending on the database driver being used).

For example in MySQL, if I have a table with 100 records and I do this:

SELECT COUNT(*), COUNT(1), COUNT(columna) FROM tabla;

It throws me three columns with a correct count.

What is the difference between these three ways of using COUNT?

Is there one of them, based on objective tests, that is more recommended or does it not matter to use any of the forms?

There is a related question: What is SQL injection and how can I avoid it? which has excellent answers on the topic of SQL Injection.

I think many of us, when we see queries like this:

"SELECT * FROM tabla WHERE id=$valor";

O well:

"INSERT INTO tabla (columna) VALUES ($valor)";

O well:

"UPDATE tabla SET columna=$valor";

or something similar, we scream to heaven (and rightly so), warning the OP that his code is vulnerable .

Indeed, we understand that the variable $valoris supplied by the user, through a form, a URL or any other external source .

If such a variable depends on the user and the programmer creates code so that the query is executed without any prevention , any malicious user can write malicious code where the external data is collected and said code will be executed.

The question

In many cases, when vulnerable code is noticed, some argue that it is test data and that it is a test database. In other words, it doesn't matter if tables are deleted or if control of the database is taken, after all it is test data.

But... what if our system itself is at risk?

My question is if SQL Injection has an impact only at the database level or if any malicious user can also access our system (not only the database) and execute commands within it .

Or put another way: could SQL Injection go further than SQL? .

When declaring the primary key (PK) of a table (eg USER), there are several options:

• An existing field ( username) can be placed as a primary key (natural key), so the username will be validated so that there is no other equal. For example:

  CREATE TABLE usuarios(
    username VARCHAR(30) not null;
    password VARCHAR(30) not null;
    tipo_u   VARCHAR(10) null;
  
    PRIMARY KEY(username)
  ) ENGINE INNODB
  

• A new field ( iduser) can be added as a primary key (surrogate key), perhaps auto-incremental if desired. For example:

  CREATE TABLE usuarios(
    iduser   INT not null AUTO_INCREMENT;
    username VARCHAR(30) not null;
    password VARCHAR(30) not null;
    tipo_u   VARCHAR(10) null;
  
    PRIMARY KEY(iduser)
  ) ENGINE INNODB
  

Is one of the two more recommended? Which of the two ways allows a better performance in a database? What advantages does each method bring?

Is it more secure using the iduser? I really don't see much use for it, but I have seen that many sites use it like this.

Situation

When executing the following queries, the same number of records is obtained, I would like to know what is the difference of using a (+)at the end of the query.

SELECT A.IDTABLAA,B.NOMBRETABLAB
FROM TABLA_A A, TABLA_B B
WHERE A.IDTABLAA=B.IDTABLAB

--Record Count: 2,265

SELECT A.IDTABLAA, B.NOMBRETABLAB
FROM TABLA_A A, TABLA_B B
WHERE A.IDTABLAA=B.IDTABLAB(+)

--Record Count: 2,265

Environment

• Database: Oracle 11g

I have a table with multiple columns, for example ID, Nombre, Edadand Pais. Of these, I have marked the column Edadas unusedwith the following statement:

alter table Persona set unused column AGE;

Now, I want to use the column Edadagain, how can I do it in Oracle (10g)?

Also, which is better, delete a column , or set it to unused ?