Develop Reference

How to validate data using sql statement to ensure user does not breach the system

I am using JDBC and mySQL to do an application for a family. After logging in into the system, the user can register for a family account. By SQL statement, I want to ensure that the input they keyed in is not repeated and they can only register when the database have a NRIC of them individually. I am working with JDBC and implementing the SQL statement in Java also. For now my problem is the system does not validate the input the user keys in and let's the information to be passed to database easily. Would appreciate some help!
*NRIC = Identity Card No
Snapshots of Database:
User Database
Family Account Database
Code
public boolean regFamily(FamilyAccount myFam, Customer myCust) throws Exception {
int fid = 0;
try {
String selectStatement2 = "SELECT * from familyok.user where nric = ? and familyid is NOT NULL ";
PreparedStatement pStmt2 = con.prepareStatement(selectStatement2);
pStmt2.setString(1, myCust.getNric());
ResultSet rs2 = pStmt2.executeQuery();
if (rs2.next()) {
String insertStatement = "Insert into familyok.familyaccount (familyname, fnric1, fnric2, fnric3)";
insertStatement = insertStatement + "values (?,?,?,?)";
PreparedStatement prepStmt = con.prepareStatement(insertStatement);
prepStmt.setString(1, myFam.getFamilyname());
prepStmt.setString(2, myFam.getFnric1());
prepStmt.setString(3, myFam.getFnric2());
prepStmt.setString(4, myFam.getFnric3());
int status = prepStmt.executeUpdate();
if (status != 0) {
String selectStatement = "SELECT fid FROM familyok.familyaccount WHERE fnric1=?";
PreparedStatement pStmt = con.prepareStatement(selectStatement);
pStmt.setString(1, myFam.getFnric1());
ResultSet rs = pStmt.executeQuery();
if (rs.next()) {
System.out.println(rs.getInt("fid") + "\t");
fid = rs.getInt("fid");
String updateStatement = "update familyok.user set familyid=?, familyname1=? where nric in (?,?,?)";
PreparedStatement preparedStmt = con.prepareStatement(updateStatement);
preparedStmt.setInt(1, fid);
preparedStmt.setString(2, myFam.getFamilyname());
preparedStmt.setString(3, myFam.getFnric1());
preparedStmt.setString(4, myFam.getFnric2());
preparedStmt.setString(5, myFam.getFnric3());
int status2 = preparedStmt.executeUpdate();
System.out.println("update=" + preparedStmt.toString());
if (status2 != 0) {
System.out.println("Family Account Created");
return true;
}
}
}
}
else
{
System.out.println("Can't Register");
return false;
}
} catch (Exception ex) {
throw new Exception("Error: " + ex.getMessage());
}
return false;
}

how to resolve error SQL Exception thrown: java.sql.SQLException: Operation not allowed after ResultSet closed [duplicate]

This question already has answers here:
Java JDBC MySQL exception: "Operation not allowed after ResultSet closed"
(2 answers)
Closed 6 years ago.
I am trying to run following code but getting error:
SQL Exception thrown: java.sql.SQLException: Operation not allowed
after ResultSet closed.
How to resolve this error? I need two result sets for my application.
public static void main(String[] args) {
String connectionUrl = "jdbc:mysql://127.0.0.1:3306/test";
String dbUser = "root";
String dbPwd = "Syntel#92";
Connection conn;
ResultSet rs, res1 = null;
Statement stmt = null;
int rowcount = 0;
// String queryString = "create table job_status_table as select j1.job_id,s1.Source_ID,s1.Source_name from JOb_list j1,SOURCE_DETAILS s1 where s1.Source_ID = j1.Source_ID";
String queryString = "create table job_status_table as select source_id,source_name from source_details";
String addcolumn = "alter table job_status_table add column Source_rowcount int";
String fetchdata = "Select Source_name from job_status_table";
try {
conn = DriverManager.getConnection(connectionUrl, dbUser, dbPwd);
stmt = conn.createStatement();
// get record count from table job_status_table1
// stmt.executeQuery("select count() from job_status_table1");
// create table
stmt.executeUpdate(queryString);
System.out.println("Table created in the database");
stmt.executeUpdate(addcolumn);
System.out.println("alter table");
rs = stmt.executeQuery(fetchdata);
System.out.println("fetch data");
while (rs.next()) {
String table_count = null;
String table_name = null;
table_name = rs.getString("Source_name");
System.out.println(table_name);
// table_name = rs.getString("Source_name");
//System.out.println(table_name);
//rs.close();
table_count = "select count(*) from " + table_name;
//table_count = "select count(*) from " + table_name;
//rs.close();
// res1 = stmt.executeQuery(table_count);
res1 = stmt.executeQuery(table_count);
//System.out.print(res1);
if (res1.next()) {
rowcount = res1.getInt(1);//res1.getInt(1);
System.out.println("Result set values" + rowcount);
} else {
System.out.println("value is not present in resultset");
}
System.out.println("Get Row Count");
System.out.println(table_count);
// int cnt = rcnt(table_count);
String updaterow = "update job_status_table set Source_rowcount ="
+ rowcount
+ " where Source_name = '"
+ table_name
+ "'";
System.out.println("updateoutput" +stmt.executeUpdate(updaterow));
System.out.println("Update Complete");
}
/* if (conn != null) {
rs.close();
res1.close();
stmt.close();
conn.close();
conn = null;
}
*/
}
catch (SQLException sqle) {
System.out.println("SQL Exception thrown: " + sqle);
}
}
}**

You could try this:
First copy the ResultSet rs in an ArrayList and close it.
Iterate over the ArrayList and close res1 before the update.
And I don't think the else with "value is not present in resultset" is reachable, but if you should set the rowcount to 0.
EDIT
After reading the referenced question the second time:
The problem is the reusing of stmt for res1 and the update

Operation not allowed after ResultSet closed (mysql, java)

I was stuck with the error , here my line number 42 is while(rs.next()){, please help me with this i am stuck at this for few hrs.
> Exception in thread "main" java.sql.SQLException: Operation not allowed after ResultSet closed
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:998)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:937)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:926)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:872)
at com.mysql.jdbc.ResultSetImpl.checkClosed(ResultSetImpl.java:740)
at com.mysql.jdbc.ResultSetImpl.next(ResultSetImpl.java:6326)
at removeStopwords.RemoveStopwords.main(RemoveStopwords.java:42)
This is my code:
package removeStopwords;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.StringTokenizer;
import com.mysql.jdbc.Connection;
import com.mysql.jdbc.Statement;
public class RemoveStopwords {
// JDBC driver name and database URL
static final String JDBC_DRIVER = "com.mysql.jdbc.Driver";
static final String DB_URL = "jdbc:mysql://localhost/mydbv2";
// Database credentials
static final String USER = "root";
static final String PASS = "***";
public static void main(String[] args) throws ClassNotFoundException, SQLException {
Connection conn = null;
Statement stmt = null;
Class.forName("com.mysql.jdbc.Driver");
conn = (Connection) DriverManager.getConnection(DB_URL, USER, PASS);
stmt = (Statement) conn.createStatement();
String sql;
ResultSet rs = null;
ResultSet rs2 = null;
ResultSet rs3 = null;
java.sql.PreparedStatement ps = null;
int event_id = 10;
sql = "SELECT id,text from tweet where event_id = " + event_id;
rs = stmt.executeQuery(sql);
String text = "";
Long id;
while (rs.next()) {
id = rs.getLong("id");
text = rs.getString("text");
System.out.println("tweet = " + text);
text = text.replaceAll("http[^\\s]+", "");
text = text.replaceAll("www[^\\s]+", "");
System.out.println("tweet after removal of links= " + text);
StringTokenizer st = new StringTokenizer(text);
while (st.hasMoreTokens()) {
String stopword = st.nextToken();
System.out.println("stopword : " + stopword);
sql = "SELECT * from stopwords WHERE word =" + '"'+stopword+'"';
rs2 = stmt.executeQuery(sql);
if (rs2.next()) {
text = text.replaceAll(stopword, "");
System.out.println("tweet after removing stopword = " + text);
}
sql = "SELECT * from filtertweet where tweet_id = " + id + "";
rs3 = stmt.executeQuery(sql);
if (!rs3.next()) {
sql = "INSERT INTO filtertweet VALUES(?,?)";
ps = conn.prepareStatement(sql);
ps.setLong(1, id);
ps.setString(2, text);
ps.executeUpdate();
}
}
}
stmt.close();
conn.close();
}
}

A Statement object can have only one active ResultSet, so when you execute rs2 = stmt.executeQuery(sql), the first ResultSet (rs) gets closed.
Create two Statement objects, one for rs and another for rs2.
Quoting the javadoc of Statement:
By default, only one ResultSet object per Statement object can be open at the same time. Therefore, if the reading of one ResultSet object is interleaved with the reading of another, each must have been generated by different Statement objects. All execution methods in the Statement interface implicitly close a statment's current ResultSet object if an open one exists.

One ResultSet for one Statement is valid. When you are executing multiple queries use various Statements.
public static void main(String[] args) throws ClassNotFoundException, SQLException {
Connection conn = null;
Statement stmt = null;
Class.forName("com.mysql.jdbc.Driver");
conn = (Connection) DriverManager.getConnection(DB_URL, USER, PASS);
stmt = (Statement) conn.createStatement();
String sql;
ResultSet rs = null;
ResultSet rs2 = null;
ResultSet rs3 = null;
java.sql.PreparedStatement ps = null;
int event_id = 10;
sql = "SELECT id,text from tweet where event_id = " + event_id;
rs = stmt.executeQuery(sql);
String text = "";
Long id;
while (rs.next()) {
id = rs.getLong("id");
text = rs.getString("text");
System.out.println("tweet = " + text);
text = text.replaceAll("http[^\\s]+", "");
text = text.replaceAll("www[^\\s]+", "");
System.out.println("tweet after removal of links= " + text);
StringTokenizer st = new StringTokenizer(text);
while (st.hasMoreTokens()) {
String stopword = st.nextToken();
System.out.println("stopword : " + stopword);
sql = "SELECT * from stopwords WHERE word =" + '"'+stopword+'"';
Statement stmt2 = conn.createStatement();
rs2 = stmt2.executeQuery(sql);
if (rs2.next()) {
text = text.replaceAll(stopword, "");
System.out.println("tweet after removing stopword = " + text);
}
sql = "SELECT * from filtertweet where tweet_id = " + id + "";
Statement stmt3 = conn.createStatement();
rs3 = stmt3.executeQuery(sql);
if (!rs3.next()) {
sql = "INSERT INTO filtertweet VALUES(?,?)";
ps = conn.prepareStatement(sql);
ps.setLong(1, id);
ps.setString(2, text);
ps.executeUpdate();
}
}
}
stmt.close();
conn.close();
}

JDBC does not allow you to close the Statement that created the ResultSet or to execute another query that creates a ResultSet using the same Statement. Create different Statement objects and Resultset objects, make sure to not use the same Statement objects to execute two different Resultset statements.

Java sql Data pulling in the columnName but not the data

On this java method I am trying to get data from a ms-sql server. I am trying to get the int value from a column , Now the columns I am using are all int's but for some reason when i try pulling it as a INT I am getting a number format error saying that the column is a nvarchar. Not sure what is happening and when i ran the System.out I am noticing I am only pulling the column name but no data that the column has. Here is my method, I am not sure what I am doing wrong or what is missing from this. Any help will be greatly appreciated thank you.
private boolean CheckEmployee(long bDays) throws ClassNotFoundException, SQLException {
PreparedStatement preparedStatement;
String type = getTypeOfTimeOff().replaceAll("\\s+","");
Connection conn = null;
Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
conn = DriverManager.getConnection(url, userName, password);
String selectProject = "SELECT ? FROM EmpVacationTbl Where FullName =? "
+ "AND ManagerName =?";
preparedStatement = conn.prepareStatement(selectProject);
preparedStatement.setString(1, getTypeOfTimeOff().replaceAll("\\s+",""));
preparedStatement.setString(2, getEmpName());
preparedStatement.setString(3, getManagerName());
System.out.println(preparedStatement.toString());
try (ResultSet rs = preparedStatement.executeQuery())
{
while (rs.next())
{
//int checker = rs.getInt(1);
String acheck = rs.getString(1);
System.out.println("TIME off the user has : " + acheck);
int checker = Integer.valueOf(acheck);
if(checker < bDays)
{
conn.close();
message = "Too many days";
return false;
}
else
{
conn.close();
return true;
}
}
if (rs.wasNull()) {
{
conn.close();
message = "Unable to find the days";
return false;
}
}
}
conn.close();
message = "Information not matching recordings.";
return false;
}

try {
stmt = con.createStatement();
ResultSet rs = stmt.executeQuery(query);
while (rs.next()) {
int aCheck = rs.getInt("column name");
}
}catch(){}
like this

For some reason what i did was add an AS to my query along with adding a if statement to my code caused the resultset to work with my code and allowed me to pull numbers from my database. Thank you for your help. Here is the updated code i added if it helps anyone.
private boolean CheckEmployee(long bDays) throws ClassNotFoundException, SQLException {
PreparedStatement preparedStatement;
Connection conn = null;
Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
conn = DriverManager.getConnection(url, userName, password);
String selectProject = null;
if(getTypeOfTimeOff().equalsIgnoreCase("Vacation Day"))
selectProject = "SELECT VacationDay As dayList FROM EmpVacationTbl Where FullName =? "
+ "AND ManagerName =?";
else if(getTypeOfTimeOff().equalsIgnoreCase("Bonus Day"))
selectProject = "SELECT BonusDay As dayList FROM EmpVacationTbl Where FullName =? "
+ "AND ManagerName =?";
else if(getTypeOfTimeOff().equalsIgnoreCase("Birthday Day"))
selectProject = "SELECT BirthdayDay As dayList FROM EmpVacationTbl Where FullName =? "
+ "AND ManagerName =?";
System.out.println("Query String : " + selectProject);
preparedStatement = conn.prepareStatement(selectProject);
preparedStatement.setString(1, getEmpName());
preparedStatement.setString(2, getManagerName());
System.out.println(preparedStatement.toString());
try (ResultSet rs = preparedStatement.executeQuery())
{
while (rs.next())
{
int checker = 0 ;
checker = rs.getInt("dayList");
System.out.println("Days the user has off are: " + checker );
if(checker < bDays)
{
conn.close();
message = "Too many days";
return false;
}
else
{
conn.close();
return true;
}
}
if (rs.wasNull()) {
{
conn.close();
message = "Unable to find the days";
return false;
}
}
}
conn.close();
message = "Information not matching recordings.";
return false;
}

How to run SQL(MYSQL) stored procedure in JAVA jdbc?

I'm a MySQL user and I have been using following statements in MySQL Workbench :
(these statements are based on Select column names whose entries are not null)
SET group_concat_max_len = 4294967295;
SELECT GROUP_CONCAT(
' SELECT ',QUOTE(COLUMN_NAME),
' FROM ( select * from table_name where s3_01 = ', coloumn1,' ) abc',
' WHERE `',REPLACE(COLUMN_NAME, '`', '``'),'` IS NOT NULL',
' HAVING COUNT(*)'
SEPARATOR ' UNION ALL ')
INTO #sql
FROM INFORMATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = DATABASE()
AND TABLE_NAME = 'table_name';
PREPARE stmt FROM #sql;
EXECUTE stmt;
DEALLOCATE PREPARE stmt;
Although it work in my workbench, I do not know how to make it work in java.
for example, I made following code:
String sql1 = "SET group_concat_max_len = 4294967295;";
String sql2 = " SELECT GROUP_CONCAT(' SELECT ',QUOTE(COLUMN_NAME), ' FROM ( select * from ptc_weight where s3_01 = ',column1,' ) abc', ' WHERE `',REPLACE(COLUMN_NAME, '`', '``'),'` IS NOT NULL', ' HAVING COUNT(*)' SEPARATOR ' UNION ALL ') INTO #sql FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'ptc_weight'; ";
String sql3 = " PREPARE stmt FROM #sql; ";
String sql4 = " EXECUTE stmt;";
String sql5 = " DEALLOCATE PREPARE stmt;";
String[] result = getResult(sql1+sql2+sql3+sql4+sql5);
public static String[][] getResult(String sql) {
System.out.println(sql);
Connection con = null;
PreparedStatement ps = null;
ResultSet rs = null;
String[][] resultTable = null;
try {
con = getCon();
ps = con.prepareStatement(sql);
rs = ps.executeQuery();
ResultSetMetaData result = rs.getMetaData();
int rowNum=0;
// Go to the last row
rs.last();
rowNum = rs.getRow();
// Reset row before iterating to get data
rs.beforeFirst();
int colNum = result.getColumnCount();
resultTable = new String[rowNum][colNum];
for(int itr1=0; itr1<rowNum; itr1++){
rs.next();
for(int itr2=0; itr2<colNum; itr2++){
resultTable[itr1][itr2] = rs.getObject(itr2+1).toString();
}
}
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} finally {
dbclose(con, ps, rs);
}// finally
return resultTable;
}
However, it does not work. I guess I made a wrong code for utilizing stored procedure, but I don't have any idea to deal with this problem.

CallableStatement callableStatement = null;
String getDBUSERByUserIdSql = "{call getDBUSERByUserId(?,?,?,?)}";
callableStatement.setInt(1, 10);
callableStatement.registerOutParameter(2, java.sql.Types.VARCHAR);
callableStatement.registerOutParameter(3, java.sql.Types.VARCHAR);
callableStatement.registerOutParameter(4, java.sql.Types.DATE);
// execute getDBUSERByUserId store procedure
callableStatement.executeUpdate();
String userName = callableStatement.getString(2);
String createdBy = callableStatement.getString(3);
Date createdDate = callableStatement.getDate(4);
System.out.println("UserName : " + userName);
System.out.println("CreatedBy : " + createdBy);
System.out.println("CreatedDate : " + createdDate);
Here Is Full Example. You can modify your code as you need.
Simple one with less argument and with resultset :
CallableStatement cstmt = con.prepareCall("{call getEmployeeDetails(?, ?)}");
cstmt.setInt("employeeId", 123);
cstmt.setInt("companyId", 456);
ResultSet rs = cstmt.executeQuery();