We Keep Coding

How to replace a string in a string with integer type in java?

I have a requirement. The technology is quite old doesn't support spring at all . It is pure java application with jdbc connection.
Requirement is :
Suppose
select * from employee where empid = <<empid>> and designation = 'Doctor'
I am trying to replace <> with actual int value in java . How I can do it ?
String query = "select * from employee where empid = <<empid>> and designation = 'Doctor'";
if(query.contains("<<empid>>"))
/// Here I want to replace <<empid>> with actual int value in java
Any leads will be helpful

The code you didn't paste, that actually executes the SQL is either [A] a massive security leak that needs serious rewrites, or [B] is using PreparedStatement.
Here's the problem: SQL injection. Creating the SQL string by mixing a template or a bunch of string constants together with a bunch of user input is a security leak. For example, if you try to make SELECT * FROM users WHERE email = 'foo#bar.com' by e.g. String sql = "SELECT * FROM users WHERE email = '" + email + "'";, the problem is, what if the user puts in the web form, in the 'email' field: whatever#foo.com'; DROP TABLE users CASCADE; EXEC 'FORMAT C: /y /force'; --? Then the SQL becomes:
SELECT * FROM users WHERE email = 'whatever#foo.com'; DROP TABLE users CASCADE; EXEC 'FORMAT C: /y /force'; --';
That is legal SQL and you really, really, really don't want your DB engine to execute it.
Each DB engine has its own ideas on what's actually legal, and may do crazy things such as treating curly quotes as real quotes, etc. So, there is no feasible blacklist or whitelist technology you can think of that will properly cover all the bases: You need to ask your DB engine to do this for you, you can't fix this hole yourself.
Java supports this, via java.sql.PreparedStatement. You instead always pass a fully constant SQL string to the engine, and then fill in the blanks, so to speak:
PreparedStatement ps = con.prepareStatement("SELECT * FROM users WHERE email = ?");
ps.setString(1, "foo#whatever.com");
ps.query();
That's how you do it (and add try-with-resources just like you should already be doing here; statements and resultsets are resources you must always close). Even if you call .setString(1, "foo#whatever.com'; DROP TABLE users CASCADE; --"), then it'll simply look for a row in the database that has that mouthful in the email field. It will not delete the entire users table. Security hole eliminated (and this is the only feasible way to eliminate it).
So, check out that code. Is it using preparedstatement? In that case, well, one way or another that code needs to be calling:
ps.setInt(1, 999);
Where ps is the PreparedStatement object created with connection.prepareStatement(...) where ... is either an SQL constant or at least your input string where the <<empid>> was replaced with a question mark and never with any string input from an untrusted source. The 1 in ps.setInt(1, 999) is the position of the question mark (1 = the first question becomes 999), and the 999 is your actual number. It may look like:
if (input instanceof String) {
ps.setString(idx++, (String) input);
} else if (input instanceof Integer) {
ps.setInt(idx++, ((Integer) input).intValue());
} ...
etcetera. If you don't see that, find the setInt invoke and figure out how to get there. If you don't see any setInt, then what you want is not possible without making some updates to this code.
If you don't even see PreparedStatement anywhere in the code, oh dear! Take that server offline right now, research if a security leak has occurred, if this server stored european data you have 72 hours to notify all users if it has or you can't reasonably figure out e.g. by inspecting logs that it hasn't, or you're in breach of the GDPR. Then rewrite that part using PreparedStatement to solve the problem.

DAO: diffrence between InMemory implementation and Database Implementation

I'm confusing with implementation of CRUD methods for DAODatabase (for Oracle 11 xe).
The problem is that the "U"-method (update) in case of storing in generally to a Map collection inserts a new element or renews it (key-value data like ID:AbstractBusinessObject) in a Map collection. And you don't care about it, when you write something like myHashMap.add(element). This method (update) is widely used in project's business logic.
Obviously, in case of using Oracle I must care about both inserting and renewing of existing elements. But I'm stucked to choose the way how to implement it:
There is no intrinsic function for so-called UPSERT in Oracle (at least in xe11g r2 version). However, I can emulate necessary function by SQL-query like this:
INSERT INTO mytable (id1, t1)
SELECT 11, 'x1' FROM DUAL
WHERE NOT EXISTS (SELECT id1 FROM mytble WHERE id1 = 11);
UPDATE mytable SET t1 = 'x1' WHERE id1 = 11;
(src:http://stackoverflow.com/a/21310345/2938167)
By using this kind of query (first - insert, second - update) I presume that the data mostly will be inserted not updated (at least it will be rather rare). (May it be not optimal for concurrency?).
Ok, it is possible. But at this point I'm confusing to decide:
-- should I write an SQL function (with approriate arguments of course) for this and call it via Java
-- or should I simply handle a serie of queries for preparedStatements and do them via .executeUpdate/.executeQuery? Should I handle the whole UPSERT SQL code for one preparedStatment or split it into several SQL-queries and prepared statements inside one method's body? (I'm using Tomcat's pool of connections and I pass a connection instance via static method getConnection() to each method implementation in DAODatabase) ?
Is there another possibility to solve the UPSERT quest?

The equivalent to your UPSERT statement would seem to be to use MERGE:
MERGE INTO mytable d
USING ( SELECT 11 AS id, 'x1' AS t1 FROM DUAL ) s
ON ( d.id = s.id )
WHEN NOT MATCHED THEN
INSERT ( d.id, d.t1 ) VALUES ( s.id, s.t1 )
WHEN MATCHED THEN
UPDATE SET d.t1 = s.t1;
You could also use (or wrap in a procedure):
DECLARE
p_id MYTABLE.ID%TYPE := 11;
p_t1 MYTABLE.T1%TYPE := 'x1';
BEGIN
UPDATE mytable
SET t1 = p_t1
WHERE id = p_id;
IF SQL%ROWCOUNT = 0 THEN
INSERT INTO mytable ( id, t1 ) VALUES ( p_id, p_t1 );
END IF;
END;
/
However, when you are handling a CRUD request - if you are doing a Create action then it should be represented by an INSERT (and if something already exists then you ought to throw the equivalent of the HTTP status code 400 Bad Request or 409 Conflict, as appropriate) and if you are doing an Update action it should be represented by an UPDATE (and if nothing is there to update then return the equivalent error to 404 Not Found.
So, while MERGE fits your description I don't think it is representative of a RESTful action as you ought to be separating the actions to their appropriate end-points rather than combining then into a joint action.

How to mix java loops with SQL conditional selects

So I would like to do a select from an SQL database, using Java, subject to a conditional statement (less than or equal to something) subject to some loop in Java. In other words, something like the following:
for (int i=0; i< 195; i++) {
// Get the results of the SQL query
resultSet = statement.executeQuery(
"SELECT max( millisFromMid ) FROM stockInfo1 WHERE ( millisFromMid <= 34200000 + (120000)*i ) GROUP BY stockID"
);
Now Java is returning an exception here, because it doesn't want me to use "i" in this condition; however, without being able to use it here, I'm not sure how I can change this condition. The problem is this: I'm looking to retrieve data from one database, with the intent of doing some manipulation and putting the results into a new database. These manipulations depend on taking the most recent data available, which is why I'm wanting to increase the number bounding millisFromMid. Does that make sense?
Does anyone have a suggestion on how someone might do something like this? This seems like a fundamental skill to have when using Java and SQL together, so I'd very much like to know it.

The SQL statement is parsed and run in a different environment than your Java code - different language, different scope, and unless you use SQLite they run in different processes or even different machines. Because of that, you can't just refer to the Java variable i from your SQL code - you have to either inject it or use special API.
The first option - injection - is to simply put the value of i inside the string:
"SELECT max( millisFromMid ) FROM stockInfo1 WHERE ( millisFromMid <= 34200000 + (120000)*"+i+" ) GROUP BY stockID"
Personally, I prefer to do it using String.format - but that's just me.
String.format("SELECT max( millisFromMid ) FROM stockInfo1 WHERE ( millisFromMid <= 34200000 + (120000)*%d ) GROUP BY stockID",i)
The second option - via API - is more complex but also faster(especially if you combine it with transactions) - using SQL parameters. You need to create a prepared statement:
PreparedStatement preparedStatement = connection.prepareStatement("SELECT max( millisFromMid ) FROM stockInfo1 WHERE ( millisFromMid <= 34200000 + (120000)*? ) GROUP BY stockID")
Notice the ? that is replacing the i - this is your parameter. You create prepareStatement once - before the loop, and inside the loop you set the parameter every time and execute it:
for (int i=0; i< 195; i++) {
preparedStatement.setInt(1,i); //Set the paramater to the current value of i.
resultSet = preparedStatement.executeQuery(); //Execute the statement - each time with different value of the parameter.
}

The problem os that the database is not told about the value of i. Instead make Java put the value into the string and then submit it to the database.
string sql = "select * from foo where bar=" + i;
You need to remember at all times that the database only knows what you explicitly tell it, and that you are essentially writing code at runtime that will execute on another host.

You can generate an sql string and call it via jdbc, using bind variable is more correct from performance, security. It also saves you from escaping any special characters.
Since you are learning about using sql with jdbc, please read about bind variables. An example is here

PreparedStatement multiple replacements without a comma separator

I have the following PreparedStatement:
PreparedStatement statement = conn.prepareStatement("Select * from foo
where foo.age ? ? AND foo.children ? ?")
Now to explain what I am looking to do, because I am lazy and don't like writing multiple queries. I want the statement to look like the following when finished:
Select * from foo where foo.age >= 42 AND foo.children <= 3
OR
Select * from foo where foo.age = 42 AND foo.children = 3
If it isn't clear I want to be able to substitute multiple tokens in a row, where the first token happens to be a qualifier (equals,greater,less,etc) and the token following it happens to be a literal (3,17,"Steve",etc). My question is is this possible and if so how can this be accomplished?

You can't do this, because ? doesn't represent a token, but rather a value. Obviously some tokens (namely literals) represent values, but even for these, the ? directly represents the value itself, not the literal-that-also-represents-the-value. (This is an intentional element of the design, because the very purpose of parameterized queries is to prevent parameters from "leaking out" and being interpreted as something other than single values.)
Edited to add: Where I work, we have a custom framework that wraps around JDBC and handles transactions and so on, so we don't usually have to deal with PreparedStatement directly. That framework has a method that looks something like this:
public <T> Iterator<T> executeQuery(ConverterFromResultSetToT<T> converter,
String query, Map<String, Object> params)
{
// . . . modify query, replacing any instances of $!{paramKey} with the
// corresponding value from params -- this allows arbitrary SQL code
// to be injected, in the rare cases that that's necessary
// . . . modify query, replacing any instances of ${paramKey} with '?' and
// adding the corresponding value from params to an array -- we use
// this much more often
// . . . create PreparedStatement with the resulting query
// . . . set parameters of PreparedStatement from aforemented array
// . . . run PreparedStatement; wrap result in an Iterator<T>; and return
}
But I'd only recommend that sort of thing if you expect to be doing a lot of this. We put a lot of effort into that framework, and it's incredibly useful, but it's also a lot of code.
It's worth noting that, despite what the documentation might imply, the cost of creating a PreparedStatement is not very high. Unless you're really running the same query a large number of times, it's not a big deal if you re-create the PreparedStatement each time. So you don't really need built-in support for drop-in operators, as long as you're willing to write your own code for that.

This cannot be done. The parameters in a PreparedSatement can only be values, not operators, table names and such like.
Now, for the specific queries above you can do the following:
select * from foo where age > ? and age < ?
Then with 42, 400 you get age>=42 years and with 42, 42 you get age = 42

You can have a workaround as :
String query = "Select * from foo where foo.age # # AND foo.children # #";
//write code here to manipulate your query string using
query = query.replaceFirst("#", "=");
query = query.replaceFirst("#", "42");
query = query.replaceFirst("#", "=");
query = query.replaceFirst("#", "3");
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(query );
If you decide to use replaceFirst as above, please be aware that you are assigning the value from left to right.

String firstOperator = ">="
String secondOperator = "<="
PreparedStatement statement = conn.prepareStatement("Select * from foo
where foo.age "+firstOperator+" ? AND foo.children "+secondOperator+" ?");
statement.setInt(1,42);
statement.setInt(2,3);
Anyway I don't think it's a very elegant thing to do. "Not writing multiple queries" doesn't seem to be a sensible design goal.

Query runs on DB but throws exception in java

I'm having some trouble executing a nested sql query. It works fine when i run it on TOAD (for Oracle DB) but when I try and execute the same query from my java program it gives me an error : ORA-00923: FROM keyword not found where expected:
Here is the query:
Select *
from(select tb1.Number, tb1.Desc, tb1.Local, tb2.Division
from tb1
inner join tb2
on tb1.Number = tb2.Number
and Local in ('ENG_USA', 'ENG_CHINA', 'FR_FRENCH'))
where Number in ('7512','4706')
Like I mentioned, it executes fine on Toad and is able to retrieve data but the same query throws the ORA-00923 exception.
rset = stmt.executeQuery(Select *
from(select tb1.Number, tb1.Desc, tb1.Local, tb2.Division
from tb1
inner join tb2
on tb1.Number = tb2.Number
and Local in ("+loc+"))
where Number in ("+s+")
Reply With Quote

I had a similar issue with mysql. My problem was that i splitted the query in multiple rows without leaving a space between 2 rows.
So your query should be:
rset = stmt.executeQuery("Select * from(select tb1.Number, tb1.Desc, tb1.Local, tb2.Division from tb1 inner join tb2 on tb1.Number = tb2.Number and Local in ("+loc+")) where Number in ("+s+")"
PS: I would like to write this as a comment but for some reason i can't in this question. Sorry!

First off, I don't see the beginning or ending double-quotes in your Java code. Since your Java code must compile in order to get far enough to receive an Oracle error, I'm assuming that there is a double quote prior to the SELECT, a double-quote after the final close paren, and then another close parent to match to the open paren on the executeQuery. So I'm assuming that your actual code is something like
rset = stmt.executeQuery(
"Select *
from(select tb1.Number, tb1.Desc, tb1.Local, tb2.Division
from tb1
inner join tb2
on tb1.Number = tb2.Number
and Local in ("+loc+"))
where Number in ("+s+")");
Is there a reason that you're building the SQL statement dynamically rather than using bind variables? Using bind variables is more secure since you don't need to worry about SQL injection attacks. It is more efficient since you're not forcing the database to hard parse the query every time. And it saves you from many sorts of errors around quoting and escaping. In your case, assuming that the local variable loc does not have the leading and trailing single quotes, you'd need to include those in your query
rset = stmt.executeQuery(
"Select *
from(select tb1.Number, tb1.Desc, tb1.Local, tb2.Division
from tb1
inner join tb2
on tb1.Number = tb2.Number
and Local in ('"+loc+"'))
where Number in ("+s+")");
Had you used bind variables and just bound loc to the first bind variable, on the other hand, you wouldn't need to worry about adding the single quotes (or escaping any single quotes in loc.