Dynamic SQL in 3 tier client server

Question

Hi
We are supporting a 3 tier application which uses static SQL in the mid tier to talk to an Oracle database. This uses Twister from the now defunct Brokat company. As the user base continues to increase we are looking to move to use dynamic SQL, but are unsure of the syntax. Our current code would look something like
StringBuffer sb = new StringBuffer();
sb.append("SELECT * FROM MESSAGE WHERE ACCOUNT_NUMBER ='");
sb.append(getAccount());
sb.append("'");
inPool.set("statement",sb.toString());
myOracle.process("execute", inPool, outPool);
where the last 2 statements are Twister specific. Twister must be treated as something of a black box.
Has anyone got any ideas on what we would need to change?

Answer 1

Hi
We are supporting a 3 tier application which uses
static SQL in the mid tier to talk to an Oracle
database. This uses Twister from the now defunct
Brokat company. As the user base continues to
increase we are looking to move to use dynamic SQL,
but are unsure of the syntax. Our current code would
look something like
StringBuffer sb = new StringBuffer();
sb.append("SELECT * FROM MESSAGE WHERE ACCOUNT_NUMBER
='");
sb.append(getAccount());
sb.append("'");
inPool.set("statement",sb.toString());
myOracle.process("execute", inPool, outPool);
where the last 2 statements are Twister specific.
Twister must be treated as something of a black box.
Has anyone got any ideas on what we would need to
change?You want to do something like this:
// SQL statement for prepared statement
String sql= "SELECT * FROM MESSAGE WHERE ACCOUNT_NUMBER = ?";
// Get a connection (we use a pool)
Connection conn = DBUtil.getConnection ();
// Prepare the SQL
PreparedStatement acctPS = conn.prepareCall(sql);
// Bind the value
acctPS.setString(1,getAccount());
ResultSet rset = acctPS.executeQuery();
while (rset.next())
// Process the result set
rset.close();
acctPS.close();