Mailing-List: contact users-help@camel.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@camel.apache.org
Received-SPF: pass (nike.apache.org: domain of tommy.chheng@gmail.com
 designates 209.85.212.173 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=date:from:to:message-id:in-reply-to:references:subject:x-mailer
         :mime-version:content-type:content-transfer-encoding;
        b=vwcgActLy913Q1FIIPrBZieJL2G00dllBgDZEyR3oB0/LGvRBcB/SEO9uGjw6EFNN7
         RZOl9Tey5Uje0v4MkFfd3lCXemfUYEgNw9Zylsx5Y5wDIUojNmUTROCBxYQri2DoCc99
         5JrPvJSrl1ezsX5LFaWYyA8haq4BeN0vyFCxo=
Date: Thu, 30 Dec 2010 11:15:32 -0800
From: Tommy Chheng <tommy.chheng@gmail.com>
To: users@camel.apache.org
Message-ID: <D3B3B73203E04256AD16699C0FD24E22@gmail.com>
In-Reply-To: <AANLkTikMCzowGwex=_k-gj9UEYq50ytM4M4Y3QrhE-We@mail.gmail.com>
References: <6B0A7F3B19694810ABBD810348AE21AE@gmail.com>
 <AANLkTikMCzowGwex=_k-gj9UEYq50ytM4M4Y3QrhE-We@mail.gmail.com>
Subject: Re: prepared statements in camel-jdbc?
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="4d1cda54_5a83b7f9_2c25"
Content-Transfer-Encoding: 8bit

--4d1cda54_5a83b7f9_2c25
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline

 Thanks Christian, looks like the camel-sql is a better fit than the camel-jdbc component. It handles the prepared statements the way i needed it.


The prepared statement is safer than manually constructing the sql statement in a bean because I create the sql statement string based on an external xml input.


-- 
@tommychheng
http://tommy.chheng.com


On Monday, December 27, 2010 at 8:52 AM, Christian Müller wrote:

> Hello Tommy!
> 
> I didn't understand how the prepared statement can be an improvement here
> (preventing sql injection) when the sql is constructed in your bean. Could
> you please explain in more detail what do you want. At present, the
> camel-jdbc component expects a sql query or sql update in the exchange in
> message body which is executed (without resolving placeholders).
> 
> May be the camel-sql [1] component is what you are looking for. This
> component use a prepared statement
> (org.springframework.jdbc.core.PreparedStatementCallback) and also do
> placeholder resolving.
> 
> [1] http://camel.apache.org/sql-component.html
> 
> Cheers,
> Christian
> 
> On Mon, Dec 27, 2010 at 7:59 AM, Tommy Chheng <tommy.chheng@gmail.com>wrote:
> 
> 
> > Is it possible to use jdbc's prepared statements with camel-jdbc?
> > It's more for a matter of preventing sql injection than performance.
> > 
> > 
> > My route is using a bean to transform an xml data input into a insert
> > statement like this:
> > from("direct:xmlInput").
> > bean(classOf[xmlTransformToSql]).
> > log("Received: ${body}").
> > to("jdbc:test_data")
> > 
> > 
> > I'm escaping the input in the bean but a prepared statement would be more
> > secure.
> > 
> > 
> > 
> > --
> > @tommychheng
> > http://tommy.chheng.com
> > 
> > 
> 
> 
> 
> 


--4d1cda54_5a83b7f9_2c25--