Mailing-List: contact user-help@cayenne.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@cayenne.apache.org
Received-SPF: pass (athena.apache.org: domain of mkienenb@gmail.com designates
 74.125.82.171 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        b=cLG6NEBH9eIc1j6nkIlcxadzcE5ntj6kEqAxMpWvHOgSR8O5sT1sj/1qmPe+4U9nKe
         uAIghQqN4oPhJVBFA0ManCWgIioPCmfjL9ha67YfUcERatGK8V7pEE2e1ScRc4/nj1JM
         tab8VWiKcHJQMI4kde3ey3GqNG+kShY2/rFUk=
MIME-Version: 1.0
In-Reply-To: <BCE39C1C-682F-4F4D-ADD4-1A7956FA64BB@objectstyle.org>
References: <4CDDC27A.1050505@buk.cvut.cz>
 <BCE39C1C-682F-4F4D-ADD4-1A7956FA64BB@objectstyle.org>
From: Mike Kienenberger <mkienenb@gmail.com>
Date: Mon, 15 Nov 2010 07:43:20 -0500
Message-ID: <AANLkTimvG2jZy05R_vp_m7B8duQV8ym=CXtUPup7jraw@mail.gmail.com>
Subject: Re: Dynamic SQL object query
To: user@cayenne.apache.org
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

Another important distinction is that the former will prevent SQL
injection attacks, while the latter can make such attacks possible.

http://en.wikipedia.org/wiki/SQL_injection

On Sun, Nov 14, 2010 at 2:06 PM, Andrus Adamchik <andrus@objectstyle.org> w=
rote:
>
> On Nov 13, 2010, at 12:40 AM, Marek =C5=A0abo wrote:
>
>
>> SELECT #result('COUNT(id)' 'Long' 'count')
>> from User #chain('AND' 'WHERE') #chunk($userId) id =3D #bind($userId) #e=
nd #chunk($userName) userInfo.name LIKE $userName #end #end
>
>> becuase of "userInfo.name" which is object-style. So my first question i=
s whether there is a way of accomplishing this with EJBQL so I don't have t=
o work with joins there.
>
>
> Yeah, something like this should work:
>
> SELECT COUNT(a) FROM User a WHERE a.id =3D :userId AND a.userInfo.name li=
ke :userName
>
>> Second, what is the difference between #bind($a) and just $a. Both works=
 and I suppose it's close to similar.
>
> The former results in a JDBC parameter inclusion and a call to PreparedSt=
atement.setXYZ(a), the later is embedded in the SQL as a String. So the for=
mer let's JDBC driver to do the right type conversions and is a recommended=
 way to insert *parameter* objects in the query. The later form can be used=
 to dynamically build parts of SQL query that are not parameters. It will w=
ork for some parameters as well (e.g. Strings), but won't work for others (=
e.g. Date).
>
> Andrus