Mailing-List: contact user-java-help@ibatis.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user-java@ibatis.apache.org
Received-SPF: pass (nike.apache.org: domain of nathan.maves@gmail.com
 designates 209.85.128.184 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type;
        b=IGCVaGXvGLKYk6hUB/J0axK4/0aIth/03sWYq189idlNZkAjbIM71NtQyRwwRknnrw
         a0Udcua4CnCmYhwmKZnDGiftraguahAzjpdAe166HEa2iaRpd2k+X2S1wQ8K5z6v4Esr
         ixNgLXvy9IkkJwoUP8k33g9gDFLHuZOX8yhTs=
MIME-Version: 1.0
In-Reply-To: <10268b3e0904281524q19b6bdc6tf72535fabc780de6@mail.gmail.com>
References: <10268b3e0904281524q19b6bdc6tf72535fabc780de6@mail.gmail.com>
From: Nathan Maves <nathan.maves@gmail.com>
Date: Tue, 28 Apr 2009 21:30:56 -0600
Message-ID: <2f55db670904282030o66f04b3ei1b8881a0a9f76cc9@mail.gmail.com>
Subject: Re: Using #PARAM# constructions within $DYNAMICSQL$
To: user-java@ibatis.apache.org
Content-Type: multipart/alternative; boundary=001485f27f5c45240e0468a93665

--001485f27f5c45240e0468a93665
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit

I have not tried this but I don't see why it would not work.


SELECT * FROM person
 WHERE person.lastname LIKE '%'||#lastname#||'%'

the || is the concat operator for oracle.  it might be something else in
another vendor

On Tue, Apr 28, 2009 at 4:24 PM, DelGurth <delgurth@gmail.com> wrote:

> Hi,
>
> I was wondering if it was possible to use #PARAM# constructions within
> a $DYNAMICSQL$ query.I'm currently using iBatis sqlmap 2.3.0. And I'm
> trying to get the following to work:
>
> SELECT * FROM person
>  $DYNAMICSQL$
>
> With $DYNAMICSQL$ defined as: WHERE person.lastname LIKE '%#LASTNAME#%'
>
> So the query being send to the database will end up as:
>
> SELECT * FROM person
>  WHERE person.lastname LIKE '%?%'
>
> With that I hope the filter I'm creating is less prone to SQL
> Injection since the user data #LASTNAME# is still entered using bind
> variables and thus properly escaped.
>
> Just doing as above currently gives me #LASTNAME# within the query, so
> it doesn't seem to be working. But I was hoping I'm doing something
> wrong. Or is the $$ construction being parsed/replaced in the same run
> as the ## construction? And if that's the case, is there some way to
> change that behaviour of iBatis, or is there a reason you shouldn't
> want that?
>
> I hope you can help me.
>
> Regards,
> Wessel van Norel
>

--001485f27f5c45240e0468a93665
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

I have not tried this but I don&#39;t see why it would not work.<br><br><br=
>
SELECT * FROM person<br>
=C2=A0WHERE person.lastname LIKE &#39;%&#39;||#lastname#||&#39;%&#39;<br><b=
r>the || is the concat operator for oracle.=C2=A0 it might be something els=
e in another vendor<br><br><div class=3D"gmail_quote">On Tue, Apr 28, 2009 =
at 4:24 PM, DelGurth <span dir=3D"ltr">&lt;<a href=3D"mailto:delgurth@gmail=
.com">delgurth@gmail.com</a>&gt;</span> wrote:<br>

<blockquote class=3D"gmail_quote" style=3D"border-left: 1px solid rgb(204, =
204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hi,<br>
<br>
I was wondering if it was possible to use #PARAM# constructions within<br>
a $DYNAMICSQL$ query.I&#39;m currently using iBatis sqlmap 2.3.0. And I&#39=
;m<br>
trying to get the following to work:<br>
<br>
SELECT * FROM person<br>
=C2=A0$DYNAMICSQL$<br>
<br>
With $DYNAMICSQL$ defined as: WHERE person.lastname LIKE &#39;%#LASTNAME#%&=
#39;<br>
<br>
So the query being send to the database will end up as:<br>
<br>
SELECT * FROM person<br>
=C2=A0WHERE person.lastname LIKE &#39;%?%&#39;<br>
<br>
With that I hope the filter I&#39;m creating is less prone to SQL<br>
Injection since the user data #LASTNAME# is still entered using bind<br>
variables and thus properly escaped.<br>
<br>
Just doing as above currently gives me #LASTNAME# within the query, so<br>
it doesn&#39;t seem to be working. But I was hoping I&#39;m doing something=
<br>
wrong. Or is the $$ construction being parsed/replaced in the same run<br>
as the ## construction? And if that&#39;s the case, is there some way to<br=
>
change that behaviour of iBatis, or is there a reason you shouldn&#39;t<br>
want that?<br>
<br>
I hope you can help me.<br>
<br>
Regards,<br>
Wessel van Norel<br>
</blockquote></div><br>

--001485f27f5c45240e0468a93665--