Project

General

Profile

« Previous | Next » 

Revision 6606

Added by ben leinfelder over 12 years ago

uses prepared statement instead of plain old statement.
deprecated the DBConnection.createStatement() method to discourage direct parameter value use in favor of parameter binding.
http://bugzilla.ecoinformatics.org/show_bug.cgi?id=5527

View differences:

MCTestCase.java
25 25 

  		




  26
  26
  
    
package edu.ucsb.nceas;


  		




  27
  27
  
    

  		




  28
  
  
    
import junit.framework.TestCase;


  		




  29
  
  
    

  		




  30
  28
  
    
import java.io.BufferedReader;


  		




  31
  29
  
    
import java.io.File;


  		




  32
  30
  
    
import java.io.FileReader;


  		




  ......




  38
  36
  
    
import java.sql.ResultSet;


  		




  39
  37
  
    
import java.sql.ResultSetMetaData;


  		




  40
  38
  
    
import java.sql.SQLException;


  		




  41
  
  
    
import java.sql.Statement;


  		




  42
  
  
    
import java.util.Calendar;


  		




  43
  
  
    
import java.util.Date;


  		




  44
  
  
    
import java.util.GregorianCalendar;


  		




  45
  39
  
    
import java.util.HashMap;


  		




  46
  40
  
    
import java.util.Hashtable;


  		




  47
  
  
    
import java.util.SimpleTimeZone;


  		




  48
  
  
    
import java.util.TimeZone;


  		




  49
  41
  
    
import java.util.Vector;


  		




  50
  42
  
    

  		




  
  43
  
    
import junit.framework.TestCase;


  		




  
  44
  
    

  		




  51
  45
  
    
import org.apache.http.client.HttpClient;


  		




  52
  46
  
    
import org.apache.http.impl.client.DefaultHttpClient;


  		




  53
  47
  
    

  		




  54
  
  
    
import edu.ucsb.nceas.metacat.database.DBConnection;


  		




  55
  
  
    
import edu.ucsb.nceas.metacat.database.DBConnectionPool;


  		




  56
  48
  
    
import edu.ucsb.nceas.metacat.client.InsufficientKarmaException;


  		




  57
  49
  
    
import edu.ucsb.nceas.metacat.client.Metacat;


  		




  58
  50
  
    
import edu.ucsb.nceas.metacat.client.MetacatException;


  		




  59
  51
  
    
import edu.ucsb.nceas.metacat.client.MetacatFactory;


  		




  60
  52
  
    
import edu.ucsb.nceas.metacat.client.MetacatInaccessibleException;


  		




  
  53
  
    
import edu.ucsb.nceas.metacat.database.DBConnection;


  		




  
  54
  
    
import edu.ucsb.nceas.metacat.database.DBConnectionPool;


  		




  61
  55
  
    
import edu.ucsb.nceas.metacat.properties.PropertyService;


  		




  62
  56
  
    
import edu.ucsb.nceas.metacat.shared.ServiceException;


  		




  63
  57
  
    
import edu.ucsb.nceas.metacat.util.DocumentUtil;


  		




  ......




  508
  502
  
    
	protected static void dbQuery(String sqlStatement, String methodName)


  		




  509
  503
  
    
			throws SQLException {


  		




  510
  504
  
    

  		




  511
  
  
    
		DBConnectionPool connPool = DBConnectionPool.getInstance();


  		




  512
  505
  
    
		DBConnection dbconn = DBConnectionPool.getDBConnection(methodName);


  		




  513
  506
  
    
		int serialNumber = dbconn.getCheckOutSerialNumber();


  		




  514
  507
  
    

  		




  515
  
  
    
		Statement statement = dbconn.createStatement();


  		




  516
  
  
    

  		




  
  508
  
    
		PreparedStatement statement = dbconn.prepareStatement(sqlStatement);


  		




  517
  509
  
    
		debug("Executing against db: " + sqlStatement);


  		




  518
  
  
    
		statement.executeQuery(sqlStatement);


  		




  
  510
  
    
		statement.executeQuery();


  		




  519
  511
  
    

  		




  520
  512
  
    
		statement.close();


  		




  521
  513
  
    
		


  		




  ......




  525
  517
  
    
	protected static void dbUpdate(String sqlStatement, String methodName)


  		




  526
  518
  
    
			throws SQLException {


  		




  527
  519
  
    

  		




  528
  
  
    
		DBConnectionPool connPool = DBConnectionPool.getInstance();


  		




  529
  520
  
    
		DBConnection dbconn = DBConnectionPool.getDBConnection(methodName);


  		




  530
  521
  
    
		int serialNumber = dbconn.getCheckOutSerialNumber();


  		




  531
  522
  
    

  		




  532
  
  
    
		Statement statement = dbconn.createStatement();


  		




  533
  
  
    

  		




  
  523
  
    
		PreparedStatement statement = dbconn.prepareStatement(sqlStatement);


  		




  534
  524
  
    
		debug("Executing against db: " + sqlStatement);


  		




  535
  
  
    
		statement.executeUpdate(sqlStatement);


  		




  536
  
  
    

  		




  
  525
  
    
		statement.executeUpdate();


  		




  537
  526
  
    
		statement.close();


  		




  538
  527
  
    

  		




  539
  528
  
    
		DBConnectionPool.returnDBConnection(dbconn, serialNumber);


  		












Also available in:  Unified diff