Re: Prepared Statements

Dmitry Tkach wrote:
> Fernando Nasser wrote:
> 
>>>
>>
>> I don't believe this is actually being sent to the backend, maybe it 
>> is just a toString() bug.
> 
> 
> You better do believe it. I tried it, and it works. :-)
> 
>>
>> The backend should get:
>>
>> select * from user where id='null;drop database mydb'
>>
>> (If it does not it is a bug.) 
> 
> 
> Nah... That's what it would get if you did setString()... setObject () 
> doesn't work that way.
> I tend to agree, it's a bug - if the type is INTEGER, it should be 
> checking if the object, passed in is really numeric.
> 
> The thing is that, at least, in the current state of the driver, this is 
> a *really nice* bug, that gives you the only way to use certain 
> functionality....
> For example:
> 
> PreparedStatement stmt = c.prepareStatement ("select * from mytable 
> where data in ?");
> stmt.setObject (1, "(1,2,3,4,5)", Types.INTEGER);
> 
> ... if the "bug" was fixed, there would be no other way to do this kind 
> of thing :-(
> 

Well, I guess the bug will have be fixed asap as it is a security risk.

What is the proper JDBC way for filling IN lists in prepared statements?

-- 
Fernando Nasser
Red Hat Canada Ltd.                     E-Mail:  fnasser@redhat.com
2323 Yonge Street, Suite #300
Toronto, Ontario   M4P 2C9