From: Vernon Wu <vernonw@gatewaytech.com>
To: pgsql-sql@postgresql.org
Subject: Re: How does postgres handle non literal string values
Date: Tue, 03 Dec 2002 21:22:37 -0800
Message-ID: <2FXV72GHB762VC01VURWMGPMNMD8.3ded911d@kimiko> (raw)
In-Reply-To: <3DE39BC7.8000603@clearmetrix.com>
In general, it isn't a good idea to have SQL statements in JSP files. A good practise is using Mode 2. The Struts is a
popular Mode 2 framework. If your application is very small and it won't grow into a big one, you can get around using
Mode 1. In the situation, the SQL tags of JSTL will be a recommeded mechanism.
11/26/2002 8:05:27 AM, "Charles H. Woloszynski" <chw@clearmetrix.com> wrote:
>Actually, we use JDBC Prepared Statements for this type of work. You
>put a query with '?' in as placeholders and then add in the values and
>the library takes care of the encoding issues. This avoids the double
>encoding of (encode X as String, decode string and encode as SQL X on
>the line). There was a good article about a framework that did this in
>JavaReport about a 18 months ago.
>
>We have gleaned some ideas from that article to create a framework
>around using PreparedStatements as the primary interface to the
>database. I'd suggest looking at them. They really make your code much
>more robust.
>
>Charlie
>
>
>>"')..."
>>
>>You *will* want to escape the username and password otherwise I'll be able to
>>come along and insert any values I like into your database. I can't believe
>>the JDBC classes don't provide
>>
>>1. Some way to escape value strings
>>2. Some form of placeholders to deal with this
>>
>>
>>
>
>--
>
>
>Charles H. Woloszynski
>
>ClearMetrix, Inc.
>115 Research Drive
>Bethlehem, PA 18015
>
>tel: 610-419-2210 x400
>fax: 240-371-3256
>web: www.clearmetrix.com
>
>
>
>
>
>---------------------------(end of broadcast)---------------------------
>TIP 5: Have you checked our extensive FAQ?
>
>http://www.postgresql.org/users-lounge/docs/faq.html
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: vernonw@gatewaytech.com
Subject: Re: How does postgres handle non literal string values
In-Reply-To: <2FXV72GHB762VC01VURWMGPMNMD8.3ded911d@kimiko>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox