Develop Reference

What does "my_something" means in oracle sql query?

I have some Java code that runs an SQL query like this:
SELECT DISTINCT ven.enterprise_network_id, st.*
FROM studies st
inner join v_enterprise_network_members ven on st.ib_id = my_ib_id
WHERE ven.ib_id=:IB_ID
AND (st.myvrn_expiration_date IS NULL OR st.myvrn_expiration_Date >= sysdate)
ORDER BY st.study_date DESC
I understand everything except I don't understand what st.ib_id=my_ib_id. What does it mean? This is the whole method just in case if it helps:
public List<Study> searchRepository(StudySearchCriteria criteria, boolean isEnterpriseNetwork,
boolean isExactNameMatch) {
String selectForNone = null;
String studyStatus = null;
studyStatus = verifyStudyStatus(criteria, studyStatus, isEnterpriseNetwork);
if (criteria.contains(SearchField.STUDY_STATUS) && StringUtils.isBlank(studyStatus)) {
return new ArrayList<>();
}
if (StringUtils.isNotBlank(studyStatus) && studyStatus.contains(StudyPacsState.State.NONE.toString())) {
selectForNone = "DISTINCT {st.*}, st.study_date as stdate FROM studies st";
}
StringBuffer select = new StringBuffer(512);
StringBuffer where = new StringBuffer(512);
StringBuffer orderBy = new StringBuffer(selectForNone != null ? "" : " ORDER BY st.study_date DESC ");
select.append("SELECT ");
if (criteria.containsWildcard()) {
select.append(queryHint);
}
if (!isEnterpriseNetwork) {
select.append(selectForNone != null ? selectForNone : "DISTINCT {st.*} FROM studies st");
where.append(" WHERE st.ib_id=:IB_ID AND ").append(myVrnSql);
}
else {
///////////////////////////////////// HERE IS WHERE my_ib_id is
select.append("DISTINCT ven.enterprise_network_id, {st.*} FROM studies st")
.append(" inner join v_enterprise_network_members ven on st.ib_id=my_ib_id ");
/////////////////////////////////////
where.append(" WHERE ven.ib_id=:IB_ID AND ").append(myVrnSql);
}
StringBuilder queryForNone = selectForNone != null ? new StringBuilder(" UNION ") : new StringBuilder(" ");
createStudyStatusQuery(criteria, isExactNameMatch, studyStatus, where, queryForNone, false);
buildStudyQuery(criteria, select, where, orderBy, isEnterpriseNetwork, isExactNameMatch, true, false);
if (criteria.contains(SearchField.STUDY_STATUS)) {
select.append(" , smr_study_pacs_state sps ");
}
SQLQuery sq = null;
Query hq = null;
if (isEnterpriseNetwork) {
sq = getSession().createSQLQuery(select.toString() + where.toString());
sq.addEntity("st", Study.class).addScalar("enterprise_network_id", StandardBasicTypes.LONG)
.setCacheable(false).setCacheRegion("vrnstudysearch");
}
else {
sq = getSession().createSQLQuery(select.toString() + where.toString() + queryForNone.toString());
sq.addEntity("st", Study.class).setCacheable(false).setCacheRegion("vrnstudysearch");
if (selectForNone != null) {
sq.addScalar("stdate", StandardBasicTypes.TIMESTAMP);
}
}
hq = sq;
hq.setLong(SearchField.IB_ID.toString(), (Long) criteria.get(SearchField.IB_ID));
supplyParameters(criteria, hq, isExactNameMatch);
logger.info("Query searchRepository {}", hq.getQueryString());
List<Study> result = null;
if (!isEnterpriseNetwork) {
if (selectForNone != null) {
List<?> returned = hq.list();
if (returned != null) {
result = new ArrayList<Study>();
for (Object n : returned) {
Object[] tuple = (Object[]) n;
Study st = (Study) tuple[0];
result.add(st);
}
}
}
else {
result = hq.list();
}
}
else {
List<?> returned = hq.list();
if (returned != null) {
result = new ArrayList<Study>();
for (Object n : returned) {
Object[] tuple = (Object[]) n;
Study st = (Study) tuple[0];
st.setEnterpriseNetworkId((Long) tuple[1]);
result.add(st);
}
}
}
logger.debug(" returned " + (result == null ? 0 : result.size()));
return result;
}

st.ib_id=my_ib_id is the join condition - it defines the relationship between the two tables you are joining in the query. Presumably, my_ib_id is a column in one of those tables.

Why is my jpql .getResultList() returning 0 rows for a good query

I was using the exact same query yesterday and it was working fine today I made a few changes to flow of the program and the query no longer returns and rows.
the first function that my programs goes to:
public void prepareSummary(Date startDate , Date endDate)
{
int getStartDay = getDayFromDate(startDate);
int getStartMonth = getMonthFromDate(startDate);
//
int getEndDay = getDayFromDate(endDate);
int getEndMonth = getMonthFromDate(endDate);
int getYear = getYearFromDate(startDate);
if(getStartMonth <= getEndMonth)
{
if(getStartMonth == getEndMonth)
{
if(getStartDay < getEndDay)
{
while(getStartDay <= getEndDay)
{
Calendar cal = Calendar.getInstance();
cal.set( getYear, getStartMonth, getStartDay);
Date queryStart = getStartOfDay(cal.getTime());
Date queryEnd = getEndOfDay(cal.getTime());
List<Object[]> res = getSumList(queryStart, queryEnd);
doQuery(res);
++getStartDay;
}
}
else
{
}
}
else
{
}
}
else
{
}
}
Here is what getSumList looks like:
public List<Object[]> getSumList(Date start, Date end) {
String query = "";
query += "SELECT COUNT(s) pCount,"
+ "p.nameText,"
+ "g.nameText,"
+ "t.shiftID"
+ " FROM Sheets s , GradeNames g , SpecieNames p, ShiftTimes t"
+ " WHERE s.createdLocal > :start and s.createdLocal < :end"
+ " AND s.specieNameIndex = p.nameIndex "
+ " AND s.gradeNameIndex = g.nameIndex"
+ " AND s.shiftIndex = t.shiftIndex"
+ " GROUP BY p.nameText , g.nameText , t.shiftID";
Query q = em.createQuery(query);
q.setParameter("start", start);
q.setParameter("end", end);
return q.getResultList();
}
This next function doesn't matter at this point because nothing is being executed because the list length is zero:
private void doQuery(List<Object[]> obj)
{
int length = obj.size();
String grade = null;
Long standingCount = (long) 0;
System.out.println("Length" + length);
for (int i = 0; i < length; ++i) {
// HAVE A LIST OF ALL ITEMS PULLED FROM DATABASE
Object[] tmpObj = obj.get(i);
Long tmpCount = (Long) tmpObj[0];
String tmpSpecieName = (String) tmpObj[1];
Double tmpThickness = Double.parseDouble(getSpecie().getThicknessFromSpecie(tmpSpecieName));
String tmpLength = getSpecie().getLengthFromSpecie(tmpSpecieName);
String tmpGradeName = (String) tmpObj[2];
String tmpShift = (String) tmpObj[3];
tmpSpecieName = getSpecie().getSpecieFromSpecie(tmpSpecieName);
//// END OF ALL ITEMS PULLED FROM DATABASE
if (grade != pullGradeName(tmpGradeName) && grade != null) {
System.out.println("Count:" + standingCount + "Grade:" + tmpGradeName + "--" + "Specie" + tmpSpecieName + "Shift:" + tmpShift + "Thickness:" + tmpThickness + "Length:" + tmpLength + "SpecieNAme:" + tmpSpecieName);
// do previous insert
grade = pullGradeName(tmpGradeName);
} else if (grade != pullGradeName(tmpGradeName) && grade == null) {
grade = pullGradeName(tmpGradeName);
} else if (grade == pullGradeName(tmpGradeName)) {
standingCount = standingCount + tmpCount;
}
System.out.println("Count:" + tmpCount + "Grade:" + tmpGradeName + "--" + "Specie" + tmpSpecieName + "Shift:" + tmpShift + "Thickness:" + tmpThickness + "Length:" + tmpLength + "SpecieNAme:" + tmpSpecieName);
}
}

Check the SQL that is generated, and the tables you are querying over. As the query requires inner joins, if one of the tables was cleared, it would return no results. If you want to get a 0 count, you need to use an outer join syntax which isn't possible in JPA unless you use object level mappings:
"SELECT COUNT(s) pCount,"
+ "p.nameText,"
+ "g.nameText,"
+ "t.shiftID"
+ " FROM Sheets s outer join s.specialNameIndex p,"
+ " outer join s.gradeNameIndex g, outer join s.shiftIndex t"
+ " WHERE s.createdLocal > :start and s.createdLocal < :end"
+ " GROUP BY p.nameText , g.nameText , t.shiftID";

Send email on status change

I have a project which currently only does methods when I run the site. Now I need to implement a thread which checks the DB/the website for status-changes so I can send out a mail if something occurs. I have successfully added the functionality to mail someone, and also know the logic on how to do this. The problem occurs when I try to write the code, I don't know how to do it (Since I didn't know the back-end mostly, and now I have the responsibility for the project.
The logic would be to implement a java-thread (runnable) and then check the previous color with the new one and if it has changed send out an mail (The colors are statuses, for example, green & red). What is the most understandable and easy way to do this? I'll write the function names so you get an idea of what I have.
I have been stuck with this for a week and don't know what to do. Any help would be appreciated.
The method in the class for the object that changes color:
public void setColour(List<Status> statusar, List<Category> subcategories) {
for (int index = 0; index < subcategories.size(); index++) {
if (this.statusColor.compareToIgnoreCase("red") != 0) {
if ((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("green") == 0)
&& (this.priority < ((Category)subcategories.get(index)).getPriority())) {
this.statusColor = "GREEN";
this.priority = ((Category)subcategories.get(index)).getPriority();
}
if (((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("red") == 0)
&& (((Category)subcategories.get(index)).getPriority() == 2))
|| ((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("yellow") == 0)
&& (this.priority <= ((Category)subcategories.get(index)).getPriority()))
|| ((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("yellow") == 0)
&& (((Category)subcategories.get(index)).getPriority() == 3))) {
this.statusColor = "YELLOW";
this.priority = ((Category)subcategories.get(index)).getPriority();
}
if (((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("red") == 0)
&& (((Category)subcategories.get(index)).getPriority() == 3))
|| ((((Status)statusar.get(index)).getStatusColor().compareToIgnoreCase("red") == 0)
&& (this.priority <= ((Category)subcategories.get(index)).getPriority()))) {
this.statusColor = "RED";
this.priority = ((Category)subcategories.get(index)).getPriority();
}
}
}
}
A color function I found in the DB part:
public List<Map<String, Object>> listColorsOverDays(String days, String categoryName) {
String SQL_getColors = "SELECT COUNT(*) count,color FROM ( ";
SQL_getColors += " SELECT CASE";
SQL_getColors += " WHEN CAST(status.value AS DECIMAL) >= CAST(greenFrom AS DECIMAL) AND CAST(status.value AS DECIMAL) <= CAST(greenTo AS DECIMAL) THEN 'GREEN' ";
SQL_getColors += " WHEN CAST(status.value AS DECIMAL) >= CAST(yellowFrom AS DECIMAL) AND CAST(status.value AS DECIMAL) <= CAST(yellowTo AS DECIMAL) THEN 'YELLOW' ";
SQL_getColors += " ELSE 'RED' END AS color ";
SQL_getColors += " FROM status INNER JOIN category ON status.idCategory = category.idCategory ";
SQL_getColors += " INNER JOIN threshold ON category.idCategory = threshold.idCategory ";
SQL_getColors += " WHERE status.timeStamp>DATE_SUB(NOW(), INTERVAL " + days + " DAY) ";
SQL_getColors += " AND category.name = '"+categoryName+"'";
SQL_getColors += " ) as p group by p.color";
List<Map<String, Object>> colorList = null;
try {
colorList = getJdbcTemplate().queryForList(SQL_getColors);
} catch (Exception e) {
e.printStackTrace();
}
return colorList;
}
Here's the controller which uses this function:
public List<Map<String, Object>> getColorList(String days, String categoryName) {
StatusDAO statusDao_i = (StatusDAO)this.context.getBean("statusDAO");
List<Map<String, Object>> colorList = new ArrayList();
try {
colorList = statusDao_i.listColorsOverDays(days, categoryName);
} catch (BadSqlGrammarException e) {
e.printStackTrace();
} catch (Exception e) {
e.printStackTrace();
}
return colorList;
}
A status list which contains the colors:
public List<Status> getStatusList(Status status) {
StatusDAO statusDao_i = (StatusDAO)this.context.getBean("statusDAO");
status.setCategoryId(this.categoryService_i.getCategoryId(status.getCategoryName()));
Timestamp fromTime = Timestamp.valueOf(status.getFromTime());
Timestamp toTime = Timestamp.valueOf(status.getToTime());
List<Status> statusList = new ArrayList();
try {
statusList = statusDao_i.getStatusesByTime(status, fromTime, toTime);
status.setCategoryId(this.categoryService_i.getCategoryId(status.getCategoryName()));
} catch (BadSqlGrammarException e) {
e.printStackTrace();
} catch (Exception e) {
e.printStackTrace();
}
return statusList;
}

How to prevent SQL injection attacks using parameterized queries - Play Framework

I inherited a Play 1.2.4 application which has just been security audited. It seems some methods are unsafe so I need to change them to use prepared statements.
One of the methods in question is this:
public static void surveys(int startIndex, int endIndex, boolean isAscending, String orderBy, String searchField,
String searchText, String filter) {
NdgUser currentUser = NdgUser.find("byUserName", session.get("ndgUser")).first();
NdgUser currentUserAdmin = NdgUser.find("byUserName", currentUser.userAdmin).first();
List<Survey> surveys = null;
String query;
if (filter != null && filter.length() > 0) {
query = getQuery2Filters( "available" , String.valueOf( SurveyStatusConsts.getStatusFlag( filter ) ),
"ndg_user_id", String.valueOf(currentUserAdmin.getId()), false,
searchField, searchText, null, isAscending );//sorting is not needed now
}
else {
query = getQuery( "ndg_user_id" , String.valueOf(currentUserAdmin.getId()), false,
searchField, searchText, null, isAscending );//sorting is not needed now
}
long totalItems = 0;
totalItems = Survey.count( query );
if ( orderBy != null && orderBy.equals( "resultCollection" ) ) {
surveys = Survey.find( query ).fetch();
Collections.sort( surveys, new SurveyNdgResultCollectionComapator() );
if ( !isAscending ) {
Collections.reverse( surveys );
}
int subListEndIndex = surveys.size() <= endIndex ? surveys.size() : endIndex;
surveys = surveys.subList( startIndex, subListEndIndex );
} else {
if (filter != null && filter.length() > 0) {
query = getQuery2Filters( "available", String.valueOf( SurveyStatusConsts.getStatusFlag( filter ) ),
"ndg_user_id", String.valueOf(currentUserAdmin.getId()), false,
searchField, searchText, orderBy, isAscending );
}
else {
query = getQuery( "ndg_user_id", String.valueOf(currentUserAdmin.getId()), false,
searchField, searchText, orderBy, isAscending );
}
surveys = Survey.find( query ).from( startIndex ).fetch( endIndex - startIndex );
}
serializeSurveys(surveys, startIndex, totalItems);
}
which makes use of another couple of methods to actually build the query
private static String getQuery(String filterName, String filterValue, boolean isFilterString, String searchField,
String searchText, String orderBy, boolean isAscending ) {
StringBuilder query = new StringBuilder();
String statusQuery = "";
String searchQuery = "";
String sortingQuery = "";
if ( filterName != null && filterName.length() > 0
&& filterValue != null && filterValue.length() > 0 ) {
statusQuery = filterName + "=" + ( isFilterString ? ("'" + filterValue + "'") : filterValue );
}
if ( searchField != null && searchText != null && searchText.length() > 0 ) {
if(searchField.equals("dateSent")) {
searchQuery = "DATE_FORMAT(" + searchField + ", '%d/%m/%Y')" + " like '%" + searchText + "%'";
}
else {
searchQuery = searchField + " like '%" + searchText + "%'";
}
}
if ( orderBy != null && orderBy.length()> 0 ) {
sortingQuery = "order by " + orderBy + ( isAscending ? " asc" : " desc" );
}
query.append( statusQuery )
.append( ( statusQuery.length() > 0 && searchQuery.length() > 0 ) ? " and " : ' ' )
.append( searchQuery )
.append( ' ' )
.append( sortingQuery );
return query.toString();
}
and
private static String getQuery2Filters(String filterName, String filterValue, String filterName2,
String filterValue2, boolean isFilterString, String searchField,
String searchText, String orderBy, boolean isAscending ) {
StringBuilder query = new StringBuilder();
String statusQuery = "";
String searchQuery = "";
String sortingQuery = "";
if ( filterName != null && filterName.length() > 0
&& filterValue != null && filterValue.length() > 0 ) {
statusQuery = filterName + "=" + ( isFilterString ? ("'" + filterValue + "'") : filterValue );
}
if ( filterName2 != null && filterName2.length() > 0
&& filterValue2 != null && filterValue2.length() > 0 ) {
statusQuery += " and " + filterName2 + "="
+ ( isFilterString ? ("'" + filterValue2 + "'") : filterValue2 );
}
if ( searchField != null && searchText != null && searchText.length() > 0 ) {
searchQuery = searchField + " like '%" + searchText + "%'";
}
if ( orderBy != null && orderBy.length()> 0 ) {
sortingQuery = "order by " + orderBy + ( isAscending ? " asc" : " desc" );
}
query.append( statusQuery )
.append( ( statusQuery.length() > 0 && searchQuery.length() > 0 ) ? " and " : ' ' )
.append( searchQuery )
.append( ' ' )
.append( sortingQuery );
return query.toString();
}
I believe it is these auxiliary methods I need to change for basic string concatenation to something using parameters but I am a bit lost as to how actually do that. I am not very familar with either Java or Hibernate/JPA so some pointers gratefully received

If + try - catch in method not working properly

I'm working on an SQLite based app. Everything is working fine, except my if-else statements in my method. The saving and stuff works, just the checking is giving me a pretty high blood pressure. I'm hoping one of you is much smarter than i am and finds the probably obvious mistake i made:
public void save() {
// get length of EditText
int dateLength, mileageLength, amountLength, lpriceLength, tpriceLength;
dateLength = date_widget.getText().length();
mileageLength = mileage_widget.getText().length();
amountLength = amount_widget.getText().length();
lpriceLength = price_widget.getText().length();
tpriceLength = totalPrice_widget.getText().length();
// Start save method if EditTexts are not empty.
if (dateLength > 0 || mileageLength > 0 || amountLength > 0
|| lpriceLength > 0 || tpriceLength > 0) {
// Get the value of each EditText and write it into the
// String/doubles
String date = date_widget.getText().toString();
double mileage = Double
.valueOf(mileage_widget.getText().toString());
double amount = Double.valueOf(amount_widget.getText().toString());
double lprice = Double.valueOf(price_widget.getText().toString());
double tprice = Double.valueOf(totalPrice_widget.getText()
.toString());
// Check if mileage is increasing, else cancel and show toast
int checkMileage = Integer.parseInt(db
.getSearchResult("mileage", 0));
if (checkMileage < mileage) {
try {
// if (id == null) {
db.insert(date, mileage, amount, lprice, tprice);
Toast.makeText(this, R.string.action_input_saved,
Toast.LENGTH_SHORT).show();
finish();
} catch (Exception e) {
e.printStackTrace();
Toast.makeText(this, "ERROR " + e, Toast.LENGTH_LONG)
.show();
}
} else {
Toast.makeText(
this,
"Your current mileage must be more than the last saved mileage",
Toast.LENGTH_LONG).show();
}
} else {
Toast.makeText(this, "finish your input", Toast.LENGTH_LONG).show();
}
}
My Method in the DbAdapter class:
public String getSearchResult(String sql, int cmd) {
if (cmd == 0) {
String countQuery = "SELECT " + sql + " FROM " + TABLE_NAME
+ " WHERE _id = (SELECT max(_id) FROM " + TABLE_NAME + ")";
Cursor cursor = db.rawQuery(countQuery, null);
cursor.moveToFirst();
String tmp = cursor.getString(0);
cursor.close();
// return count
return tmp;
} else if (cmd == 1) {
int sum = 0;
String countQuery = "SELECT " + sql + " FROM " + TABLE_NAME;
String idQuery = "SELECT _id FROM " + TABLE_NAME
+ " WHERE _id = (SELECT max(_id) FROM " + TABLE_NAME + ")";
Cursor cursor = db.rawQuery(countQuery, null);
Cursor id = db.rawQuery(idQuery, null);
// berechnung
cursor.moveToFirst();
id.moveToFirst();
int maxId = Integer.parseInt(id.getString(0));
for (int i = 0; i < maxId; i++) {
int tmp = Integer.parseInt(cursor.getString(0));
sum = sum + tmp;
cursor.moveToNext();
}
cursor.close();
id.close();
return String.valueOf(sum);
} else if (cmd == 2 && sql == "mileage") {
int sum = 0;
String countQuery = "SELECT " + sql + " FROM " + TABLE_NAME;
String idQuery = "SELECT _id FROM " + TABLE_NAME
+ " WHERE _id = (SELECT max(_id) FROM " + TABLE_NAME + ")";
Cursor cursor = db.rawQuery(countQuery, null);
Cursor id = db.rawQuery(idQuery, null);
// berechnung
cursor.moveToFirst();
id.moveToFirst();
int maxId = Integer.parseInt(id.getString(0));
if (maxId > 1) {
int array[] = new int[maxId];
// Array füllen
for (int i = 0; i < maxId; i++) {
array[i] = Integer.parseInt(cursor.getString(0));
// sum = sum + tmp;
cursor.moveToNext();
}
for (int k = 1; k < maxId; k++) {
int tmp;
tmp = array[k] - array[k - 1];
sum = sum + tmp;
}
cursor.close();
id.close();
return String.valueOf(sum);
} else {
return "--";
}
}
return "Wrong CMD";
}
I is pretty messy, i know

Turning comment into an answer:
Switch all || to && in your first if. Otherwise you will try to process everything even if only one field is filled in.