CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Use prepared statements instead of string concatenated SQL everywhere - WIP (FINERACT-854)

Browse Source
This commit is contained in:
Joseph Makara
2021-04-13 06:10:51 +08:00
committed by Petri Tuomola
parent f96fc7df39
commit 859ce5af62
3 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/configuration/service/ConfigurationReadPlatformServiceImpl.java
+1 -1
View File
@@ -62,7 +62,7 @@ public class ConfigurationReadPlatformServiceImpl implements ConfigurationReadPl
sql += " order by c.id";
final List<GlobalConfigurationPropertyData> globalConfiguration = this.jdbcTemplate.query(sql, this.rm,
new Object[] { DataTableApiConstant.CATEGORY_PPI });
survey ? new Object[] { DataTableApiConstant.CATEGORY_PPI } : new Object[] {});
return new GlobalConfigurationData(globalConfiguration);
}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java
+2 -2
View File
@@ -281,7 +281,7 @@ public class GenericDataServiceImpl implements GenericDataService {
final List<ResultsetColumnValueData> columnValues = new ArrayList<>();
if (codeId != null) {
final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =?" + " order by v.order_position, v.id";
final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =? order by v.order_position, v.id";
final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, Integer.class, new Object[] { codeId });
rsValues.beforeFirst();
while (rsValues.next()) {
@@ -297,7 +297,7 @@ public class GenericDataServiceImpl implements GenericDataService {
private SqlRowSet getDatatableMetaData(final String datatable) {
final String sql = "select COLUMN_NAME, IS_NULLABLE, DATA_TYPE, CHARACTER_MAXIMUM_LENGTH, COLUMN_KEY"
+ " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = ?" + " order by ORDINAL_POSITION";
+ " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = ? order by ORDINAL_POSITION";
final SqlRowSet columnDefinitions = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] { datatable });
if (columnDefinitions.next()) {