== Why is this an issue?

There can't be any good reason to do a full table scan on large database tables due to the cost of such operation and the scalability issue that might raise. This rule raises an issue when a ``++SELECT++`` statement doesn't use at least one indexed column in its ``++WHERE++`` clause.


*Note* That this rule raises issues only when a database catalog is provided during the SonarQube analysis.


=== Noncompliant code example

[source,cobol]
----
SELECT * FROM USERS WHERE NAME = :name  -- non compliant when NAME column is not indexed
----


=== Exceptions

This rule ignores ``++SELECT++`` statements not having any ``++WHERE++`` clauses; they are covered by other rules: S1590, SQL.SelectWithNoWhereClauseCheck


ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

Add at least one criterion to the "WHERE" clause using an indexed column.


=== Parameters

.threshold
****

----
1000
----

Ignore statements on tables with fewer than this many rows.
****


=== Highlighting

entire where clause


'''
== Comments And Links
(visible only on this page)

=== deprecates: S1956

=== on 8 Jan 2016, 16:14:26 Pierre-Yves Nicolas wrote:
The current message seems to imply that this rule should only be triggered if a SQL statement has a WHERE clause. However, if there is no WHERE clause, no index can be used.


Please note that we already have other rules (with a noticeable difference: they have no "threshold" parameter):

* RSPEC-1590 for DELETE and UPDATE with no WHERE clause (with a default severity set to major)
* RSPEC-1492 for SELECT with no WHERE clause (with a default severity set to critical)

=== on 8 Jan 2016, 17:19:24 Ann Campbell wrote:
\[~pierre-yves.nicolas] if this rule raises an issue on a missing ``++WHERE++`` clause, we'll get a double hit if RSPEC-1492 is also on (which is bad, IMO). But if we subsume RSPEC-1492 into this rule, then will ``++WHERE++``-less ``++SELECT++``s be found if no database information is available?


Regarding the differing severities of RSPEC-1590, and RSPEC-1492, ``++WHERE++``-less ``++SELECT++``s are widely regarded as security issues, but that's not the case for ``++WHERE++``-less ``++DELETE++`` and ``++UPDATE++`` statements. Unless I'm behind on my reading...

=== on 8 Jan 2016, 17:46:13 Pierre-Yves Nicolas wrote:
\[~ann.campbell.2] I'm fine to exclude statements without WHERE clause from this rule: I think that the description should then mention RSPEC-1492 and RSPEC-1590, perhaps in the "See also" section.



=== on 11 Jan 2016, 18:37:15 Ann Campbell wrote:
Done [~pierre-yves.nicolas] & assigning back to [~freddy.mallet] for his initial review.

endif::env-github,rspecator-view[]
