/src/edu/ucsb/nceas/metacat/Eml200SAXHandler.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 6606

Added by ben leinfelder over 12 years ago

uses prepared statement instead of plain old statement.
deprecated the DBConnection.createStatement() method to discourage direct parameter value use in favor of parameter binding.
http://bugzilla.ecoinformatics.org/show_bug.cgi?id=5527

     import java.sql.PreparedStatement;
     import java.sql.ResultSet;
     import java.sql.SQLException;
     import java.sql.Statement;
     import java.util.Date;
     import java.util.EmptyStackException;
     import java.util.Enumeration;
-...
                                     .getDBConnection("DBSAXHandler.startElement");
                             serialNumber = dbConn.getCheckOutSerialNumber();
                             Statement stmt = dbConn.createStatement();
                             ResultSet rs = stmt
                                     .executeQuery("SELECT catalog_id FROM xml_catalog "
                                             + "WHERE entry_type = 'Schema' "
                                             + "AND public_id = '" + doctype + "'");
                             String sql = "SELECT catalog_id FROM xml_catalog "
                                 + "WHERE entry_type = 'Schema' "
                                 + "AND public_id = ?";
                             PreparedStatement pstmt = dbConn.prepareStatement(sql);
                             pstmt.setString(1, doctype);
                             ResultSet rs = pstmt.executeQuery();
                             boolean hasRow = rs.next();
                             if (hasRow) {
                                 catalogid = rs.getString(1);
+                            }
                             stmt.close();
                             pstmt.close();
                             //System.out.println("here!!!!!!!!!!!!!!!!!!2");
                         }//try
                         finally {
-...
         private void deletePermissionsInAccessTableForDoc(String docid)
                 throws SAXException
+        {
             Statement stmt = null;
             PreparedStatement pstmt = null;
             try {
             	String sql = "DELETE FROM xml_access WHERE docid = ?";
                 // delete all acl records for resources related to @aclid if any
                 stmt = connection.createStatement();
                 pstmt = connection.prepareStatement(sql);
                 pstmt.setString(1, docid);
                 // Increase DBConnection usage count
                 connection.increaseUsageCount(1);
                 stmt.execute("DELETE FROM xml_access WHERE docid = '"
                         + docid + "'");
                 pstmt.execute();
             } catch (SQLException e) {
                 throw new SAXException(e.getMessage());
             } finally {
                 try {
                     stmt.close();
                     pstmt.close();
                 } catch (SQLException ee) {
                     throw new SAXException(ee.getMessage());
+                }
-...
         /* Delete access rules from xml_access for a subtee id */
         private void deleteSubtreeAccessRule(String subtreeid) throws SAXException
+        {
           Statement stmt = null;
           PreparedStatement pstmt = null;
            try
+           {
                stmt = connection.createStatement();
         	   String sql =
         		   "DELETE FROM xml_access " +
         		   "WHERE accessfileid = ? " +
                    "AND subtreeid = ?";
                pstmt = connection.prepareStatement(sql);
                pstmt.setString(1, docid);
                pstmt.setString(2, subtreeid);
                // Increase DBConnection usage count
                connection.increaseUsageCount(1);
                stmt.execute("DELETE FROM xml_access WHERE accessfileid = '"
                        + docid + "' AND subtreeid ='" + subtreeid +"'");
                pstmt.execute();
+           }
            catch (SQLException e)
+           {
-...
+           {
                try
+               {
                    stmt.close();
                    pstmt.close();
+               }
                catch (SQLException ee)
+               {
-...
         private void deleteAllInlineDataAccessRules() throws SAXException
+        {
           Statement stmt = null;
           PreparedStatement pstmt = null;
            try
+           {
                stmt = connection.createStatement();
         	   String sql =
         		   "DELETE FROM xml_access " +
         		   "WHERE accessfileid = ? AND subtreeid IS NOT NULL";
                pstmt = connection.prepareStatement(sql);
                pstmt.setString(1, docid);
                // Increase DBConnection usage count
                connection.increaseUsageCount(1);
                stmt.execute("DELETE FROM xml_access WHERE accessfileid = '"
                        + docid + "' AND subtreeid IS NOT NULL");
                pstmt.execute();
+           }
            catch (SQLException e)
+           {
-...
+           {
                try
+               {
                    stmt.close();
                    pstmt.close();
+               }
                catch (SQLException ee)
+               {
-...
         /* Delete every access subtree record from xml_accesssubtree. */
         private void deleteAccessSubTreeRecord(String docId) throws SAXException
+        {
             Statement stmt = null;
             PreparedStatement pstmt = null;
             try {
             	String sql = "DELETE FROM xml_accesssubtree WHERE docid = ?";
                 // delete all acl records for resources related to @aclid if any
                 stmt = connection.createStatement();
                 pstmt = connection.prepareStatement(sql);
                 pstmt.setString(1, docId);
                 // Increase DBConnection usage count
                 connection.increaseUsageCount(1);
                 logMetacat.debug("running sql: DELETE FROM xml_accesssubtree WHERE docid = '"
                         + docId + "'");
                 stmt.execute("DELETE FROM xml_accesssubtree WHERE docid = '"
                         + docId + "'");
                 logMetacat.debug("running sql: " + sql);
                 pstmt.execute();
             } catch (SQLException e) {
                 throw new SAXException(e.getMessage());
             } finally {
                 try {
                     stmt.close();
                     pstmt.close();
                 } catch (SQLException ee) {
                     throw new SAXException(ee.getMessage());
+                }

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 6606

Added by ben leinfelder over 12 years ago