1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
| protected void save(Connection p_conn)
throws SQLException, NoRowSelectedException,
BlahException, InvalidParamInQueryException,
ParseException, InvalidParameterException, Exception {
String sSQL = null;
PreparedStatement updatePS = null;
String sId = FormBox.getNotEmptyParam(req, "id_blih");
// ids
String sIdBlah = FormBox.getParamForSQL(req, "id_blah");
if ( sIdBlah==null ) {
sIdBlah="";
} // if
String idBug = FormBox.getParamForSQL(req, "id_bug");
if ( idBug==null) {
idBug"";
} // if
String idBugTest = FormBox.getParamForSQL(req, "id_bug_test");
if ( idBugTest==null ) {
idBugTest="";
} // if
String version = FormBox.getParamForSQL(req, "version");
if ( version==null ) {
version = "";
} // if
// date
String sDisDate = FormBox.getParamForSQL(req, "dis_date");
if ( (sDisDate==null) || sDisDate.equals("") ) {
sDisDate = Constants.DEFAULT_DIS_DATE;
} // if
java.util.Date oDateTmp = FormatBox.getDateShort(sDisDate);
Date oDisDate = new Date(oDateTmp.getTime());
Timestamp oLastUpdate = new Timestamp(System.currentTimeMillis());
String dated = FormBox.getParamForSQL(req, "dated");
if ( (dated==null) || !dated.equals("1") ) {
dated = "0";
} // if
// changed status
String changed = FormBox.getParamForSQL(req, "changed");
if ( (changed==null) || !changed.equals("1") ) {
changed = "0";
} // if
String ex = FormBox.getParamForSQL(req, "ex");
if ( ex==null ) {
ex="";
} // if
// changelog
String changelog = FormBox.getParamForSQL(req, "changelog");
if ( changelog==null ) {
changelog="";
} // if
// last edition date
Timestamp oEditDate = oLastUpdate;
// --------------------------------------------------------------
p_conn.setAutoCommit(false);
int last = 0;
try {
sSQL = "update t_table set "
+ " id_blah=?,"
+ " id_bug=?,"
+ " id_bug_test=?,"
+ " dis_date=?, "
+ " dated=?, "
+ " last_update=?,"
+ " version=?, "
+ " ex=?, "
+ " changelog=?, "
+ " changed=? "
+ " where id="+sId;
updatePS = p_conn.prepareStatement(sSQL);
try {
updatePS.setString(1, sIdCve);
updatePS.setString(2, idBugTraq);
updatePS.setString(3, idVendorBug);
updatePS.setDate(4, oDiscoveryDate);
if (dated == null) {
updatePS.setNull(5, java.sql.Types.NULL);
} else {
updatePS.setInt(5, (new Integer(dated)).intValue());
}
updatePS.setTimestamp(6, oLastUpdate);
updatePS.setString(7, FormatBox.formatSQL((Object)vulnerableVersion, new Integer(java.sql.Types.VARCHAR)));
updatePS.setString(8, exploit);
updatePS.setString(9, changelog);
updatePS.setInt(10, (new Integer(changed)).intValue());
updatePS.executeUpdate();
} catch (Exception e){
logger.error("erreur",e);
} finally {
updatePS.close();
}
} finally {
p_conn.rollback();
p_conn.setAutoCommit(true);
}
} |
JDBC, PreparedStatement et quotes
Répondre avec citation
Mais le but de setString, setDate etc est de les mettre eux-même (ce me semble)! L'application tourne en production... et on m'a donné les dernières sources disponible. Je ne pense pas qu'ils se soient amusés à mettre des quotes dans tout le code... 
Partager