Project

General

Profile

« Previous | Next » 

Revision 6595

View differences:

SpatialDocument.java
92 92
		 * Determine the docname/schema and decide how to proceed with spatial
93 93
		 * harvest
94 94
		 */
95
		String query = "SELECT docname FROM xml_documents WHERE docid='" + docid.trim()
96
				+ "';";
95
		String query = "SELECT docname FROM xml_documents WHERE docid = ?";
97 96
		String docname = "";
98 97
		try {
99 98
			pstmt = dbconn.prepareStatement(query);
99
			pstmt.setString(1, docid.trim());
100 100
			pstmt.execute();
101 101
			rs = pstmt.getResultSet();
102 102
			while (rs.next()) {
......
146 146
			 * Get the bounding coordinates
147 147
			 */
148 148
			query = "SELECT path, nodedatanumerical, parentnodeid FROM xml_path_index"
149
					+ " WHERE docid = '"
150
					+ docid.trim()
151
					+ "'"
152
					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = '"
153
					+ docid.trim()
154
					+ "' AND principal_name = 'public' AND perm_type = 'allow')"
149
					+ " WHERE docid = ?"
150
					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = ?"
151
					+ " AND principal_name = 'public' AND perm_type = 'allow')"
155 152
					+ " AND (path = '" + westPath + "'" + "  OR path = '" + southPath
156 153
					+ "'" + "  OR path = '" + eastPath + "'" + "  OR path = '"
157 154
					+ northPath + "'" + " ) ORDER BY parentnodeid;";
158 155

  
159 156
			try {
160 157
				pstmt = dbconn.prepareStatement(query);
158
				pstmt.setString(1, docid.trim());
159
				pstmt.setString(2, docid.trim());
161 160
				pstmt.execute();
162 161
				rs = pstmt.getResultSet();
163 162
				while (rs.next()) {
......
187 186
			try {
188 187

  
189 188
				String docTitlePath = PropertyService.getProperty("spatial.docTitle");
190
				query = "select nodedata from xml_path_index where path = '"
191
						+ docTitlePath.trim() + "' and docid = '" + docid.trim() + "'";
189
				query = "select nodedata from xml_path_index where path = ?"
190
						+ " and docid = ?";
192 191
				pstmt = dbconn.prepareStatement(query);
192
				pstmt.setString(1, docTitlePath.trim());
193
				pstmt.setString(2, docid.trim());
193 194
				pstmt.execute();
194 195
				rs = pstmt.getResultSet();
195 196
				if (rs.next())

Also available in: Unified diff