Re: Problems with prepared statements

From: Tore Halset (halse..vv.ntnu.no)
Date: Wed Nov 29 2006 - 09:03:31 EST

  • Next message: Tomi N/A: "Re: Persistence and inheritance : a noob question"

    On Nov 29, 2006, at 12:42 , Øyvind Harboe wrote:

    > So the MS Access adapter should contain a proxy jdbc driver that
    > "unprepares" statements?

    This is not related to cayenne at all, so it will be independant of
    the adapter.

    > I've never written a proxy jdbc driver nor have I unprepared
    > statements, but it sounds like fun. :-)

    You should know about all the bad things that can happen if you stop
    using prepared statements. Like security issues with sql injection.

    Create your own java.sql.Driver, Connection and PreparedStatement.
    Your Driver can handle jdbc urls like "myhack:jdbc:othervendor..".
    Your Connection wrap a underlying connection from the real database
    and forward all calls to that connection except for the calls that
    create PreparedStatements. Your PreparedStatement should wrap a
    standard Statement from the underlying jdbc driver. It should collect
    all parameters and convert the prepare sql sentence to a non-prepared
    sql sentence. You will get into lots of trouble with String escaping
    and so on... This is indeed the wrong path to follow.

      - Tore.



    This archive was generated by hypermail 2.0.0 : Wed Nov 29 2006 - 09:04:15 EST