Rewrote handling of values, now it is better secured using prepared statements

Signed-off-by:Roland Häder <roland@mxchange.org>

diff --git a/src/org/mxchange/jcore/database/backend/mysql/MySqlDatabaseBackend.java b/src/org/mxchange/jcore/database/backend/mysql/MySqlDatabaseBackend.java
index 2d71d90c2f2172b0b4f892bd518e8788d9958dab..c1a38e6a4ef8be34a289635ef021b3e496afa000 100644 (file)
--- a/src/org/mxchange/jcore/database/backend/mysql/MySqlDatabaseBackend.java
+++ b/src/org/mxchange/jcore/database/backend/mysql/MySqlDatabaseBackend.java
@@ -19,11 +19,12 @@ package org.mxchange.jcore.database.backend.mysql;
 import java.io.IOException;
 import java.sql.Connection;
 import java.sql.DriverManager;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.sql.Statement;
 import java.text.MessageFormat;
 import java.util.Iterator;
+import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
 import org.mxchange.jcore.criteria.searchable.SearchableCritera;
@@ -128,11 +129,20 @@ public class MySqlDatabaseBackend extends BaseDatabaseBackend implements Databas
                // Debug message
                this.getLogger().debug(MessageFormat.format("set.isEmpty()={0}", set.isEmpty()));
 
+               // Init values
+               Set<Object> values = new LinkedHashSet<>(set.size());
+
                // Are there conditions?
                if (!set.isEmpty()) {
                        // Continue with WHERE
                        query.append(" WHERE ");
 
+                       // No more than 1 value currently
+                       if (set.size() > 1) {
+                               // Not supported yet
+                               throw new IllegalArgumentException("More than one criteria is not supported yet.");
+                       }
+
                        // Get iterator
                        Iterator<Map.Entry<String, Object>> iterator = set.iterator();
 
@@ -153,7 +163,12 @@ public class MySqlDatabaseBackend extends BaseDatabaseBackend implements Databas
                                // Which type has the value?
                                if (value instanceof Boolean) {
                                        // Boolean value
-                                       query.append(String.format("=%s", value.toString()));
+                                       query.append("=?");
+                                       values.add(value);
+                               } else if (value instanceof String) {
+                                       // String value
+                                       query.append("=?");
+                                       values.add(value);
                                } else {
                                        // Cannot handle this
                                        throw new SQLException(MessageFormat.format("Cannot handle value={0} for key={1} in table {2}", value, entry.getKey(), this.getTableName()));
@@ -177,10 +192,49 @@ public class MySqlDatabaseBackend extends BaseDatabaseBackend implements Databas
                this.getLogger().debug(MessageFormat.format("query={0} is complete.", query));
 
                // Prepare statement instance
-               Statement statement = connection.createStatement();
+               PreparedStatement statement = connection.prepareStatement(query.toString());
+
+               // Debug message
+               this.getLogger().debug(MessageFormat.format("statement={0}", statement));
+
+               // Get iterator on values
+               Iterator<Object> valueIterator = values.iterator();
+
+               // Init index with 1
+               int index = 1;
+
+               // Set all values
+               while (valueIterator.hasNext()) {
+                       // Get next value
+                       Object value = valueIterator.next();
+
+                       //Debug message
+                       this.getLogger().debug(MessageFormat.format("value={0} at index={1}", value, index));
+
+                       // Detect type again
+                       if (value instanceof Boolean) {
+                               // Debug log
+                               this.getLogger().debug(MessageFormat.format("Setting boolean value={0} for index={1}", value, index));
+
+                               // Found boolean
+                               statement.setBoolean(index, (boolean) value);
+                       } else if (value instanceof String) {
+                               // Debug message
+                               this.getLogger().debug(MessageFormat.format("Setting string value={0} for index={1}", value, index));
+
+                               // Found string
+                               statement.setString(index, (String) value);
+                       } else {
+                               // Not parseable type
+                               throw new SQLException(MessageFormat.format("Cannot handle value={0} for index={1} in table {2}", value, index, this.getTableName()));
+                       }
+
+                       // Increment index
+                       index++;
+               }
 
                // Run it
-               ResultSet resultSet = statement.executeQuery(query.toString());
+               ResultSet resultSet = statement.executeQuery();
 
                // The result set needs to be transformed into Result, so initialize a result instance here
                Result<? extends Storeable> result = this.getFrontend().getResultFromSet(resultSet);