77

As a software engineer, I have a strong bias towards writing business logic in the application layer, while typically relying on the database for little more than CRUD (Create Retrieve Update and Delete) operations. On the other hand, I have run across applications (typically older ones) where a large amount of the business logic was written in stored procedures, so there are people out there that prefer to write business logic in the database layer.

For the people that have and/or enjoy written/writing business logic in a stored procedure, what were/are your reasons for using this method?

2
  • 15
    I'm a DBA. DATA logic should be in the database. The way you manipulate the database structures to perform the activities required by the functionality SHOULD BE held in the database. When you join up these activities into a larger series of processes (business logic) then THIS can be consolidated in the application.
    – Guy
    Sep 25, 2009 at 14:21
  • IT managers are the problem. They misuse DBAs by expecting them to be part of system development. DBAs just use the tool at hand. I'm a full stack developer. I have cleaned "data logic" for years and convinced my employer to forbid stored procedures for business processes, after extracting Excel spreadsheet work from hundreds of queries, one of which filtered FINANCIAL DATA. Processing only belongs in applications where an interface provides control and information to a user. In other words, SPs are for database work not user data entry.
    – RBJ
    Apr 17, 2020 at 17:10

16 Answers 16

49

I try to seriously limit my business logic in the DB to only procs that have to do alot of querying and updating to perform a single application operation. Some may argue that even that should be in the app, but I like to keep the IO down if I can.

Databases are great for CRUD but if they get bloated with logic:

  1. It becomes confusing where the logic is,
  2. Typically databases are a silo and do not scale horizontally nearly as well as the app servers.
  3. t_sql/PLsql is hard to read and procedural in nature
  4. You forfeit all of the benefits of OOAD.
9
  • 4
    T-SQL and other SQL variants can be hard to read, but I would consider them declarative instead of procedural--cursors being one exception. Sep 24, 2009 at 19:34
  • 2
    How do you handle transactions then? For example: Lets say that i need to create a new Order in my system. The business scenario in this case would require the system to: document the order, send an email to the customer (add a row to emailQueue table), and - (this is the tricky part) if order.type=1 -> update table1 else update table2. This all has to be in a single transaction. Would you right this in a Business Logic layer and handle the transactions in code or would you move all this to the database? Nov 21, 2013 at 12:40
  • 17
    "t_sql/PLsql is hard to read" - Based on what? It's just code. I might think Objective-C is hard to read, but another person might think it's the most intuitive language since sliced bread. Does that mean Objective-C is hard to read? Not at all. The language is just a tool, it's just syntax. You can write bad PL/SQL code, just like you can write bad C# code. But it's not the language's fault in either case, it's the person's fault who wrote the code. Whether or not a language is "hard to read" mainly depends on your familiarity with it.
    – dcp
    Jan 23, 2014 at 17:42
  • 3
    I don't necessarily agree with the answer. How do you define logic here? Is it just a bunch of calculations and derivations? or the process that intertwines it? The application is a mere presentation layer and the days of fat clients with heavy application side logic are gone. Furthermore, single bulk operations invoked from Application may suffer severe performance issues either during the logic or during DB query/Inserts/Updates/Deletes and tuning a DB side would be far more easier and efficient than tuning Application side logic. Aug 8, 2014 at 8:30
  • 1
    In addition to that, apps are moving more towards Asynchronous processing, wherein a user does operation A in the UI and moves on with operation B but operation A still runs asynchronously in the back ground without making the user wait for itself to finish. An efficient implementation of such an Asynchronous behavior is virtually impossible with total Business logic coded solely at the Application level. Aug 8, 2014 at 8:38
38

To the maximum extent possible, keep your business logic in the environment that is the most testable and debuggable. There are some valid reasons for storing business logic in the database in other people's existing answers, but they are almost always far outweighed by this.

4
  • that's true. I have also worked on very complex application and nested DB which more than half of business logic is on Database. If I wanted to put the conditions and logics on class or lib it would have been nightmare and it give access to end user to do almost access. other things e.g. Auth, ACL, comparisons,...
    – Fury
    Jan 14, 2014 at 10:11
  • 3
    And the prize for most succinct answer to this question goes to ... Mar 3, 2014 at 23:13
  • 2
    Let's see testing and debugging is maybe 1% of 1% of the time associated with a database query's life, so yes the's optimize for that. What a silly notion. Maybe just maybe if you worked in the database all the time, you wouldn't find it so hard to debug and test. I certainly don;t. Just because something is not like what you are used to is no reason not to use it if it is the best tool for the job.
    – HLGEM
    Aug 27, 2015 at 16:53
  • 2
    "Maybe just maybe if you worked in the database all the time ..." - sounds like you're admitting that you have only one tool and it's a hammer. Maybe just maybe when building logically complex systems some people prefer to ensure behavioral correctness over execution speed. "I have no idea if it's correct, but it's fast!"
    – user74754
    Mar 14, 2017 at 4:09
22

Limiting the business logic to the application layer is short-sighted at best. Experienced professional database designers rarely allow it on their systems. Database need to have constraints and triggers and stored procs to help define how the data from any source will go into it.

If the database is to maintain its integrity and to ensure that all sources of new data or data changes follow the rules, the database is the place to put the required logic. Putting it the application layer is a data nightmare waiting to happen. Databases do not get information just from one application. Business logic in the application is often unintentionally bypassed by imports (assume you got a new customer who wanted their old historical data imported to your system or a large number of target records, no one is going to enter a million possible targets through the interface, it will happen in an import.) It is also bypassed by changes made through the query window to fix one-time issues (things like increasing the price of all products by 10%). If you have application layer logic that should have been applied to the data change, it won't be. Now it's ok to put it in the application layer as well, no sense sending bad data to the database and wasting network bandwidth, but to fail to put it in the database will sooner or later cause data problems.

Another reason to keep all of this in the database has to to with the possibility of users committing fraud. If you put all your logic in the application layer, then you must grant the users access directly to the tables. If you encapsulate all your logic in stored procs, they can be limited to doing only what the stored procs allow and not anything else. I would not consider allowing any kind of access by users to a database that stores financial records or personal information (such as health records) as I would not allow anyone except a couple of dbas to directly access the production records in any way shape or form. More fraud is committed than many developers realize and almost none of them consider the possibility in their design.

If you need to import large amount of data, going through a data access layer could slow down the import to a crawl becasue it doesn't take advanatge of the set-based operations that databases are designed to handle.

12
  • 31
    Yes, data can come from more than one application, but this doesn't mean you have to put the logic in the database. What's wrong with having another layer above the database that all applications must pass through? This is the reason behind n-tier system architecture. If you wanted to import a large amount as data why assume that this will be done direct to the database? A bulk import application could be developed using a service layer, which would then funnel that data through the same business logic layer... Sep 25, 2009 at 14:29
  • 12
    All I can say is you have never spent months fixing bad data from poor designs like that. I have. Databases are not for data persiostence only.
    – HLGEM
    Sep 25, 2009 at 15:09
  • 12
    The is nothing inherently poor about a properly structured, multi tiered design. You have clearly, like most, dealt with some specifically poor designs. I’ve been there too, and it has never lead to me think it was a good idea to put all business logic in the database. In fact, the biggest, most unfathomable messes I have seen are where this HAS been done. Sep 30, 2009 at 14:57
  • 9
    @HLGEM - I really liked your answer. I totally agree that business rules need to be in the database. As to Andy's point about writing the "middle tier", what happens when that middle tier language becomes obsolete? For example, what if the middle tier was written in VB6 8 years ago? What are you going to do now to get it into a more maintainable language? Rewrite it all? If you had put the business rules in the database, they'd be there and could easily be maintained for years and years. Nobody was using Java 20 years ago, but plenty of people were using Oracle.
    – dcp
    Dec 12, 2013 at 19:45
  • 7
    @dcp And what about if your database becomes obsolete? Same argument that you made against obsolete middle tier languages... Granted that database languages last longer than many programming languages, sticking with something just because you don't want to change anything is just losing out on all the innovations that have been produced through the years as you huddle in that corner. My main gripe with database business logic is that it's almost never DRY, so a single change will require you to go through everything to make sure it all works...
    – Populus
    Jan 23, 2014 at 16:50
17

Your usage of the term "business logic" is rather vague.

It can be interpreted to mean to include the enforcement of constraints on the data (aka 'business rules'). Enforcement of these unequivocally belongs in the dbms, period.

It can also be interpreted to mean to include things like "if a new customer arrives, then within a week we send him a welcome letter." Trying to push stuff like this in the data layer is probably a big mistake. In such cases, the driver for "create a new welcome letter" should probably be the application that also triggers the new customer row insertion. Imagine every new database row insertion triggering a new welcome letter, and then suddenly we take over another company and we must integrate that company's customers in our own database ... Ouch.

2
  • 2
    This answer has the most insight.
    – Pacerier
    Dec 7, 2014 at 16:46
  • Yes, I think the question invites answers on different levels. I completely agree that data constraints should be enforced by the schema. Mar 23, 2016 at 8:56
14

We do a lot of processing in the DB tier, where appropriate. There's a lot of operations you wouldn't want to pull back large datasets to the app tier to do analysis on. It's also an easier deployment for us -- a single point vs. updating applications at all install points. But a lot depends on your application and what it does; there's no single good answer here.

7

Two good reasons for putting the business logic in the database are:

  • It secures your logic and data against additional applications that may access the database that don't implement similar logic.
  • Database designs usually outlive the application layer and it reduces the work necessary when you move to new technologies on the client side.
7
  • 3
    If you have some kind of data-integrity or other business logic in the database, do you completely leave it out of your "Business Logic" layer? Or do you duplicate it? (For example, checking that a value is valid before entering in the DB, even though the DB itself won't let you enter it?)
    – Edan Maor
    Sep 24, 2009 at 19:30
  • 38
    A database is for data persistence. If you did as you recommend, you are building for failure. Additional applications that need the same data should be controlled in how they access it and not by the data level itself. Too not do so and say, "Oh, the database controls that" is to open yourself up to huge oversights. Furthermore, database designs outlive applications because they are too difficult to change. This is also why you want to put as little into them as possible. The more logic you bundle with your data, the more you are going to have to work around as things change.
    – Ty.
    Sep 24, 2009 at 19:51
  • 3
    @Edan - duplicating the logic can make sense in certain cases where it improves performance by saving network round trips to/from the back end. You still have the safety net at the back end
    – dpbradley
    Sep 24, 2009 at 19:56
  • 8
    @Ty - We could probably both point to examples from experience that support our opinions, but once you get up to sufficiently complex applications with hundreds of tables and high transactions rates that are accessed by dozens of applications that need to share data, I'll take my logic on the back end.
    – dpbradley
    Sep 24, 2009 at 20:09
  • 2
    @Jack - care to explain? Please post your own answer to the question if you have a counterpoint.
    – dpbradley
    Dec 2, 2009 at 12:29
7

On a couple of ocassions I have put 'logic' in sprocs because the CRUD might be happening in more than one place. By 'logic' I would have to say it is not really business logic but more 'integrity logic'. It might be the same - some cleanup might be necessary if something gets deleted or updated in a certain way, and if that delete or update could happen from more than one tool with different code-bases it made sense to put it in the proc they all used.

In addition, sometimes the 'business logic line' is pretty blurry. Take reports for example - they may rely on stored procedures or views that encapsulate 'smarts' about what the schema means to the business. How often have you seen CASE statements and the like that 'do things' based on column values or other critieria? Could be construed as business logic and yet it probably does belong in the DB where it can be optimized, etc.

1
  • Good point...I have actually done similar things in the past.
    – senfo
    Sep 24, 2009 at 19:19
7

I'd say if 'business-logic' means application flow, user control, timed operations and generally 'doing-business-stuff' then it should be in the application layer. But if it means making sure that no matter how you dig around in the data, it always makes sense and is a sensible, non-self-conflicting whole, then the checks to enforce those rules go in the DB, absolutely, no questions. There are always many ways to push data into the DB and manipulate it once its there. Not all those ways have 'business-logic' built in to them. You will find a SQL session into a DB through a DOS window on a support call at 3am is very liberal in what it allows for example! If the logic isn't in the DB to make sure that ALL data changes make sense, you can bet for sure that the data will get very, very screwed up over time. And since a system is only as valuable as the data it holds, that makes for a much lower return on investment.

5

You often find business logic at the database layer because it can often be faster to make a change and deploy. I think often the best intentions are not to put the logic there but because of the ease of deployment it ends up there.

1
  • Is easier deployment more important than making unit tests possible?
    – fabpico
    Feb 21 at 13:29
4

The primary reason I would put BL in stored procs in the past is that transactions were easier in the database.

If deployments are difficult for your app and you don't have an app-server, changing the BL in stored procedures is the most effective way to deploy a change.

1
  • 1
    a few people in this thread have commented that it is easier to update/deploy changes to the DB. I don't like this argument. If it is hard to deploy your app, the answer is not to move the logic you change often to the DB, it is to fix your deployment mechanism! I work in a major financial institution and have many financial apps both desktop and web. Everyone of them can be deployed in a heartbeat without any noticeable downtime. Techniques like blue/green releases are the way to go, or apps that check for updates on start up.
    – Mark Jones
    Jan 8, 2015 at 14:53
4

I work for a financial type company where certain rules are applied by states, and these rules and their calculations are subject to change almost daily if not surely weekly. That being the case, it made more sense to move parts of the logic dealing with calculations to the database; where a change can be tested and applied without having to recompile and redistibute an application, which is impossible to do daily without disrupting business. The stored proc is tested, approved, applied and the end user is none the wiser. With the move to web based applications, the reliance on moving the logic to the database is less but still present. Even web apps (depending on the language) must be compiled and published to the site which could cause downtime.

3

Sometimes business logic is too slow to run on the app layer. This is especially true on on older systems where client power and bandwidth was more limited.

3

The main reason for using the database to do the work is that you have a single point of control. Often, app developers re-use or rewrite code fragments in different parts of the application. Even assuming that these all work exactly the same way (which is doubtful), when the business logic changes, the app needs to be reviewed, recoded, recompiled. Unless the parameters change, this would not be necessary where the business logic is stored only in the database.

3

My preference is to keep any complicated business logic out of the database, simply for maintenance purposes. If I get a call at 2 o'clock in the morning I would rather debug my application code than try to step through database scripts.

3

I'm in a team to build-up and maintain a rather large financial system, and I find no way put the logic into the application layer for action that affect to or get constraints from dozens of thousand records.

Beside the performance issue, should errors happen, rectifying a stored procedures is much faster than debugging the application, fixing, recompiling, redeploying the code with longer downtime

3
  • That is a very baseless and anecdotal claim.
    – senfo
    Dec 29, 2012 at 16:55
  • it's funny that: looking back my comment a few years ago, I'm still working on the old system. And I'm on the way to rebuild a new version of it now. However, I'm still in the same situation. I don't mean that there's no way to bring the logic execution to application layer. What I mean is I don't know how to for my case, maybe because of my limitation. I'm very pleased if someone can teach me.
    – Ben
    Feb 16, 2015 at 7:34
  • My basic demand is: update one row only, but because of many constraints, the validation execution will go through many thousands of rows, which are filtered from a tables of tens of millions records. After that many thousands of rows will be updated. It's unlimited tree level structure
    – Ben
    Feb 16, 2015 at 7:38
2

I think Specially for older applications which i working on (Banking) where the Bussiness logic is huge, it's almost next to impossible to perform all these business logic in application layer, and also It's a big performenance hit when we put these logic in Application layer where the number of fetch to the database is more, results in more resource utilization(more java objects if it's done in java layer) and network issues and forget abt performenance.

Not the answer you're looking for? Browse other questions tagged or ask your own question.