java - extract column names from sql query after where clause -
i've requirement need pull out data database. query is-
select e.data entityblob, f.data fpmlblob [trades.inventoryrecord] ir, entityblob e, fpmlblob f %s , uid = e.uid , uid = f.uid here %s predicate after clause user input html form.
user input in form :
1. tradedate = '2013-04-05' , islatest = 'true'
2. streamid= 'ia0015'
3. query may have in clause also
now when query rendered exception ambigous column streamid or ambigous column islatest, these columns exists in more 1 table same name. remove ambiguity need modify query - ir.islatest or ir.streamid
to java code, need first parse predicate after clause, extract column names , insert table name alias- 'ir' before each column name query becomes -
select e.data entityblob, f.data fpmlblob [trades.inventoryrecord] ir, entityblob e, fpmlblob f ir.tradedate = '2013-04-05' , ir.islatest = 'true' , uid = e.uid , uid = f.uid what best way parse predicate, or if there other way can achieve same result?
my answer question not parse user input - there far can go wrong. lot better have ui drop downs , buttons selecting equality, inequality, ranges, in statements, etc. may seem more work, protecting sql injection attack more. , if not concerned malicious sql injection, user still has every thing exactly right, or statement fails.
Comments
Post a Comment