Project

General

Profile

« Previous | Next » 

Revision 6629

View differences:

src/edu/ucsb/nceas/metacat/DBQuery.java
637 637
          parameterValues.addAll(docidValues);
638 638
      } else {
639 639
    	  // condition for the docids
640
    	  List<Object> docidConditionValues = new ArrayList<Object>();
640 641
    	  StringBuffer docidCondition = new StringBuffer();
641 642
    	  docidCondition.append( " docid IN (" );
642 643
          for (int i = 0; i < givenDocids.size(); i++) {  
643
        	  docidCondition.append("'");
644
        	  docidCondition.append( (String)givenDocids.elementAt(i) );
645
        	  docidCondition.append("'");
644
        	  docidCondition.append("?");
646 645
        	  if (i < givenDocids.size()-1) {
647 646
        		  docidCondition.append(",");
648 647
        	  }
648
        	  docidConditionValues.add((String)givenDocids.elementAt(i));
649 649
          }
650 650
          docidCondition.append( ") " );
651 651
		  
......
653 653
    	  if (operator == null) {
654 654
    		  query = "SELECT docid, docname, doctype, date_created, date_updated, rev FROM xml_documents WHERE";
655 655
              query = query + docidCondition.toString();
656
              parameterValues.addAll(docidConditionValues);
656 657
    	  } else {
657 658
    		  // start with the keyword query, but add conditions
658 659
              query = qspec.printSQL(useXMLIndex, docidValues);
......
667 668
	              }
668 669
              }
669 670
              query = query + myOperator + docidCondition.toString();
671
              parameterValues.addAll(docidConditionValues);
670 672

  
671 673
    	  }
672 674
      } 
673
      String ownerQuery = getOwnerQuery(user);
675
      // we don't actually use this query for anything
676
      List<Object> ownerValues = new ArrayList<Object>();
677
      String ownerQuery = getOwnerQuery(user, ownerValues);
674 678
      //logMetacat.debug("query: " + query);
675 679
      logMetacat.debug("DBQuery.findResultDoclist - owner query: " + ownerQuery);
676 680
      // if query is not the owner query, we need to check the permission
......
1065 1069
         Hashtable returnValue = new Hashtable();
1066 1070
         PreparedStatement pstmt = null;
1067 1071
         ResultSet rs = null;
1072
         
1073
         // keep track of parameter values
1074
         List<Object> parameterValues = new ArrayList<Object>();
1068 1075

  
1069 1076
         // get partOfDoclist as string for the query
1070 1077
         Iterator keylist = partOfDoclist.getDocids();
1071 1078
         StringBuffer doclist = new StringBuffer();
1072 1079
         while (keylist.hasNext())
1073 1080
         {
1074
             doclist.append("'");
1075
             doclist.append((String) keylist.next());
1076
             doclist.append("',");
1081
             doclist.append("?,");
1082
             parameterValues.add((String) keylist.next());
1077 1083
         }//while
1078 1084

  
1079

  
1080 1085
         if (doclist.length() > 0)
1081 1086
         {
1082 1087
             doclist.deleteCharAt(doclist.length() - 1); //remove the last comma
......
1091 1096
             try {
1092 1097
                 // prepare and execute the query
1093 1098
                 pstmt = dbconn.prepareStatement(query);
1099
                 // bind parameter values
1100
                 pstmt = setPreparedStatementValues(parameterValues, pstmt);
1101
                 
1094 1102
                 dbconn.increaseUsageCount(1);
1095 1103
                 pstmt.execute();
1096 1104
                 rs = pstmt.getResultSet();
......
1156 1164
               pstmt.close();
1157 1165

  
1158 1166
               // increase the usage count
1159
               query = "UPDATE xml_returnfield SET usage_count ='" + count
1160
                   + "' WHERE returnfield_id ='"+ id +"'";
1167
               query = "UPDATE xml_returnfield SET usage_count = ?"
1168
                   + " WHERE returnfield_id = ?";
1161 1169
               logMetacat.info("DBQuery.getXmlReturnfieldsTableId - ReturnField Table Update:"+ query);
1162 1170

  
1163 1171
               pstmt = dbconn.prepareStatement(query);
1172
               pstmt.setInt(1, count);
1173
               pstmt.setInt(2, id);
1164 1174
               dbconn.increaseUsageCount(1);
1165 1175
               pstmt.execute();
1166 1176
               pstmt.close();
......
1227 1237
      String fieldtype = null;
1228 1238
      String fielddata = null;
1229 1239
      String relation = null;
1240
      // keep track of parameter values
1241
      List<Object> parameterValues = new ArrayList<Object>();
1230 1242

  
1231 1243
      if (qspec.containsExtendedSQL())
1232 1244
      {
......
1236 1248
        Vector results = new Vector();
1237 1249
        Iterator keylist = docListResult.getDocids();
1238 1250
        StringBuffer doclist = new StringBuffer();
1251
        List<Object> doclistValues = new ArrayList<Object>();
1239 1252
        Vector parentidList = new Vector();
1240 1253
        Hashtable returnFieldValue = new Hashtable();
1241 1254
        while (keylist.hasNext())
1242 1255
        {
1243 1256
          String key = (String)keylist.next();
1244
          doclist.append("'");
1245
          doclist.append(key);
1246
          doclist.append("',");
1257
          doclist.append("?,");
1258
          doclistValues.add(key);
1247 1259
        }
1248 1260
        if (doclist.length() > 0)
1249 1261
        {
......
1252 1264
          boolean tableHasRows = false;
1253 1265
        
1254 1266

  
1255
          // keep track of parameter values
1256
          List<Object> parameterValues = new ArrayList<Object>();
1267
          
1257 1268
           String extendedQuery =
1258 1269
               qspec.printExtendedSQL(doclist.toString(), useXMLIndex, parameterValues);
1270
           // add them after, since the doclist clause is at the end of the generated queries
1271
           parameterValues.addAll(doclistValues);
1259 1272
           logMetacat.info("DBQuery.addReturnfield - Extended query: " + extendedQuery);
1260 1273

  
1261 1274
           if(extendedQuery != null){
......
1570 1583
    /*
1571 1584
     * A method to create a query to get owner's docid list
1572 1585
     */
1573
    private String getOwnerQuery(String owner)
1586
    private String getOwnerQuery(String owner, List<Object> parameterValues)
1574 1587
    {
1575 1588
        if (owner != null) {
1576 1589
            owner = owner.toLowerCase();
......
1586 1599
        self.append(") \n");
1587 1600
        self.append(") ");
1588 1601
        self.append(" AND (");
1589
        self.append(" lower(user_owner) = '" + owner + "'");
1602
        self.append(" lower(user_owner) = ?");
1590 1603
        self.append(") ");
1604
        parameterValues.add(owner);
1591 1605
        return self.toString();
1592 1606
    }
1593 1607

  

Also available in: Unified diff