CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Use prepared statements instead of string concatenated SQL everywhere - WIP (FINERACT-854)

Browse Source
This commit is contained in:
Joseph Makara
2021-04-13 06:10:51 +08:00
committed by Petri Tuomola
parent 43e038e5a6
commit 5919d38f69
1 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java
+11 -12
View File
@@ -261,9 +261,9 @@ public class GenericDataServiceImpl implements GenericDataService {
final List<ResultsetColumnValueData> columnValues = new ArrayList<>(); final List<ResultsetColumnValueData> columnValues = new ArrayList<>();
final String sql = "select v.id, v.code_score, v.code_value from m_code m " + " join m_code_value v on v.code_id = m.id " final String sql = "select v.id, v.code_score, v.code_value from m_code m " + " join m_code_value v on v.code_id = m.id "
+ " where m.code_name = '" + codeName + "' order by v.order_position, v.id"; + " where m.code_name = ? order by v.order_position, v.id";
final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql); final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] {codeName});
rsValues.beforeFirst(); rsValues.beforeFirst();
while (rsValues.next()) { while (rsValues.next()) {
@@ -281,9 +281,9 @@ public class GenericDataServiceImpl implements GenericDataService {
final List<ResultsetColumnValueData> columnValues = new ArrayList<>(); final List<ResultsetColumnValueData> columnValues = new ArrayList<>();
if (codeId != null) { if (codeId != null) {
final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =" + codeId final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =?"
+ " order by v.order_position, v.id"; + " order by v.order_position, v.id";
final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql); final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, Integer.class, new Object[] {codeId});
rsValues.beforeFirst(); rsValues.beforeFirst();
while (rsValues.next()) { while (rsValues.next()) {
final Integer id = rsValues.getInt("id"); final Integer id = rsValues.getInt("id");
@@ -298,10 +298,10 @@ public class GenericDataServiceImpl implements GenericDataService {
private SqlRowSet getDatatableMetaData(final String datatable) { private SqlRowSet getDatatableMetaData(final String datatable) {
final String sql = "select COLUMN_NAME, IS_NULLABLE, DATA_TYPE, CHARACTER_MAXIMUM_LENGTH, COLUMN_KEY" final String sql = "select COLUMN_NAME, IS_NULLABLE, DATA_TYPE, CHARACTER_MAXIMUM_LENGTH, COLUMN_KEY"
+ " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = '" + datatable + " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = ?"
+ "'order by ORDINAL_POSITION"; + " order by ORDINAL_POSITION";
final SqlRowSet columnDefinitions = this.jdbcTemplate.queryForRowSet(sql); final SqlRowSet columnDefinitions = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] {datatable});
if (columnDefinitions.next()) { if (columnDefinitions.next()) {
return columnDefinitions; return columnDefinitions;
} }
@@ -309,11 +309,10 @@ public class GenericDataServiceImpl implements GenericDataService {
throw new DatatableNotFoundException(datatable); throw new DatatableNotFoundException(datatable);
} }
private SqlRowSet getDatatableCodeData(final String datatable, final String columnName) { private SqlRowSet getDatatableCodeData(final String aDatatable, final String aColumnName) {
String datatableColumnName = aDatatable.toLowerCase().replaceAll("\\s", "_") + "_" + aColumnName;
final String sql = "select mc.id,mc.code_name from m_code mc join x_table_column_code_mappings xcc on xcc.code_id = mc.id where xcc.column_alias_name='" final String sql = "select mc.id,mc.code_name from m_code mc join x_table_column_code_mappings xcc on xcc.code_id = mc.id where xcc.column_alias_name=?";
+ datatable.toLowerCase().replaceAll("\\s", "_") + "_" + columnName + "'"; final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] {datatableColumnName});
final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql);
return rsValues; return rsValues;
} }