You are viewing a plain text version of this content. The canonical link for it is here.

Posted to users@jena.apache.org by Håvard Mikkelsen Ottestad <ha...@acando.no> on 2016/01/06 11:42:20 UTC

Safe update and select queries against Fuseki with user input

Hi,

I know that it’s possible to do safe queries with Jena using a QuerySolution for both update queries and select queries.

Ex.

UpdateExecutionFactory

create<https://jena.apache.org/documentation/javadoc/arq/org/apache/jena/update/UpdateExecutionFactory.html#create-org.apache.jena.update.Update-org.apache.jena.query.Dataset-org.apache.jena.query.QuerySolution->(Update<https://jena.apache.org/documentation/javadoc/arq/org/apache/jena/update/Update.html> update, Dataset<https://jena.apache.org/documentation/javadoc/arq/org/apache/jena/query/Dataset.html> dataset,QuerySolution<https://jena.apache.org/documentation/javadoc/arq/org/apache/jena/query/QuerySolution.html> inputBinding)

Is it possible to do something similar when running these queries against Fuseki over HTTP?

My scenario at the moment: Create a user with a username and email provided by the user. To be safe, for SQL, I would use a prepared statement. In Jena I would normally use a QuerySolution.

Regards,
Håvard M. Ottestad

Re: Safe update and select queries against Fuseki with user input

Posted by Martynas Jusevičius <ma...@graphity.org>.

That's a weird looking filter though. Shouldn't it be NOT EXISTS?

On Thu, Jan 7, 2016 at 10:09 AM, Håvard Mikkelsen Ottestad
<ha...@acando.no> wrote:
> Hi Andy,
>
> I tried the QueryBuilder, but it doesn’t work for update queries.
>
> The UpdateTransformOps looks good, however it seems to be removing a filter from my query. The filter is used to stop stop duplicate usernames.
>
> ##############
> ### BEFORE ###
> ##############
>
>
> PREFIX foaf: <http://xmlns.com/foaf/0.1/>
> PREFIX : <http://example.com/metadata/>
>
> INSERT {
>         GRAPH <http://example.com/usersGraph/> {
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> foaf:accountName ?username .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> :role ?role .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> :password ?password .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> :User .
>         }
> }
> WHERE{
>         FILTER ( ! EXISTS { ?a foaf:accountName ?username } ) #### THIS FILTER GETS REMOVED WHEN I TRANSFORM
> }
>
>
>
>
> #############
> ### AFTER ###
> #############
>
> PREFIX foaf: <http://xmlns.com/foaf/0.1/>
> PREFIX : <http://example.com/metadata/>
>
> INSERT {
>         GRAPH <http://example.com/usersGraph/> {
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> foaf:accountName "testUserName" .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> :role "" .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> :password "" .
>                 <http://example.com/user_930cd3ca-aae0-4201-8af4-c7af00b1e2cd> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> :User .
>         }
> }
> WHERE
> {} #### THE FILTER HERE IS MISSING !!!
>
>
>
>
> Håvard
>
>
>
>
> On 06/01/16 20:18, "Andy Seaborne" <an...@apache.org> wrote:
>
>>> Is it possible to do something similar when running these queries against Fuseki over HTTP?
>>
>>Håvard,
>>
>>What is the starting point? A string as the template or an
>>already-parsed query or update? Or building the  structure each time?
>>
>>1:: If it is a string,  parameterized sparql strings are the way to go
>>and it protects against injected strings for
>>
>>2:: There is also the QueryBuilder
>>https://jena.apache.org/documentation/extras/querybuilder/
>>that Claude can talk about.
>>
>>Last time we had a discussion about this
>>http://mail-archives.apache.org/mod_mbox/jena-dev/201506.mbox/%3C558FC784.9060407%40apache.org%3E
>>
>>3:: I put in the machinery for syntax rewriting: it does not have a
>>QuerySolution based interface:
>>
>>UpdateTransformOps / QueryTransformOps
>>
>>It would be good to know the details here of your use case: do you only
>>want to inject values for specific parameters, not partial patterns?
>>
>>It would help use further understand the different alternatives and
>>workflows.
>>
>>       Andy
>>