You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@cayenne.apache.org by Øyvind Harboe <oy...@zylin.com> on 2006/11/28 20:41:12 UTC
Problems with prepared statements
Is there a way I can disable prepared statements or somehow use an
alternative to prepared statements for my MS Access adapter?
As near as I can tell the MS Access prepared statements are flaky and
will cause bogus exceptions, as in the attached case where MS Access
reports: "Too few parameters. Expected 36."
--
�yvind Harboe
http://www.zylin.com
Re: Problems with prepared statements
Posted by Øyvind Harboe <oy...@zylin.com>.
On 11/29/06, Tore Halset <ha...@pvv.ntnu.no> wrote:
> On Nov 29, 2006, at 12:42 , Øyvind Harboe wrote:
>
> > So the MS Access adapter should contain a proxy jdbc driver that
> > "unprepares" statements?
>
> This is not related to cayenne at all, so it will be independant of
> the adapter.
>
> > I've never written a proxy jdbc driver nor have I unprepared
> > statements, but it sounds like fun. :-)
>
> You should know about all the bad things that can happen if you stop
> using prepared statements. Like security issues with sql injection.
>
> Create your own java.sql.Driver, Connection and PreparedStatement.
> Your Driver can handle jdbc urls like "myhack:jdbc:othervendor..".
> Your Connection wrap a underlying connection from the real database
> and forward all calls to that connection except for the calls that
> create PreparedStatements. Your PreparedStatement should wrap a
> standard Statement from the underlying jdbc driver. It should collect
> all parameters and convert the prepare sql sentence to a non-prepared
> sql sentence. You will get into lots of trouble with String escaping
> and so on... This is indeed the wrong path to follow.
Yuk! If I can't fix this in Cayenne, then I'll try to add some more
workarounds in the application.
At application my workaround is to use Expression.filterObjects()
instead of using a qualifier during the query if the query throws an
exception.
--
Øyvind Harboe
http://www.zylin.com
Re: Problems with prepared statements
Posted by Tore Halset <ha...@pvv.ntnu.no>.
On Nov 29, 2006, at 12:42 , Øyvind Harboe wrote:
> So the MS Access adapter should contain a proxy jdbc driver that
> "unprepares" statements?
This is not related to cayenne at all, so it will be independant of
the adapter.
> I've never written a proxy jdbc driver nor have I unprepared
> statements, but it sounds like fun. :-)
You should know about all the bad things that can happen if you stop
using prepared statements. Like security issues with sql injection.
Create your own java.sql.Driver, Connection and PreparedStatement.
Your Driver can handle jdbc urls like "myhack:jdbc:othervendor..".
Your Connection wrap a underlying connection from the real database
and forward all calls to that connection except for the calls that
create PreparedStatements. Your PreparedStatement should wrap a
standard Statement from the underlying jdbc driver. It should collect
all parameters and convert the prepare sql sentence to a non-prepared
sql sentence. You will get into lots of trouble with String escaping
and so on... This is indeed the wrong path to follow.
- Tore.
Re: Problems with prepared statements
Posted by Øyvind Harboe <oy...@zylin.com>.
On 11/29/06, Tore Halset <ha...@pvv.ntnu.no> wrote:
> Hello.
>
> Perhaps the easiest way is to create a proxy jdbc driver that
> "unprepares" all statements?
So the MS Access adapter should contain a proxy jdbc driver that
"unprepares" statements?
I've never written a proxy jdbc driver nor have I unprepared
statements, but it sounds like fun. :-)
Pointers?
--
Øyvind Harboe
http://www.zylin.com
Re: Problems with prepared statements
Posted by Tore Halset <ha...@pvv.ntnu.no>.
Hello.
Perhaps the easiest way is to create a proxy jdbc driver that
"unprepares" all statements? As you know, prepared statements are
realy a good thing :)
Regards,
- Tore.
On Nov 28, 2006, at 20:41 , Øyvind Harboe wrote:
> Is there a way I can disable prepared statements or somehow use an
> alternative to prepared statements for my MS Access adapter?
>
>
>
> As near as I can tell the MS Access prepared statements are flaky and
> will cause bogus exceptions, as in the attached case where MS Access
> reports: "Too few parameters. Expected 36."
>
>
>
> --
> Øyvind Harboe
> http://www.zylin.com
> <bogus.txt>