How to validate column name in dynamic made sql?

Question

Oracle db, jdbc, web app with struts2/spring.
Example table could be this:
CREATE TABLE album
album_id number(10)  not null,
  artist  varchar2(50) not null,
title  varchar2(50) not null,
  released  DATE,  
  CONSTRAINT album_pk PRIMARY KEY (album_id)
);In may app the user MAY search, MAY sort, and the result from an select might return 10.000 rows.
The basic sql usually look like this.
String sql = "select album_id, artist, title, released from album";Then in the html page the user can add search criteria for each column. Like type "iron maiden" in artist field, put "1982" in released field. And you all know what the exceptionally result should be from that :)
Now I need to modify the sql a bit:
if( artist search field contains stuff )
   sql = sql + " where nvl( artist,' ') like ?"
}we try use prepared statements right? So we use ? as placeholders, and then add "iron maiden" into this statement later on.
Nice, no big fuzz right, and pretty safe from sql injections i guess.
But now I have to have an if/else for every single field in the table. Boring. In my app I got like 25 tables like this, with 20 columns minimum. Copy/Paste have never been so boring.
I also might have to add "order by" with user selected columns and their order. I have to count the query to get total result in case i got to split it up in pages. So there is alot of if/else and sql = sql + "more stuff", and sticking to ? and pure prepared statements is impossible.
But doing this is not good either:
for( each element in a map)
  sql = sql + " and nvl( " + key + ",' ') like ?"
}Where key is "artist".
In struts and other tag libs its easy to make kode like:
<s:textfield name="model.addSearch( 'artist' )" value="%{model.getSearch( 'artist' )}" size="30" />
Silly example maybe, but just to make a point.
Inputed values in an html form, can very easily be a part of a dynamic created sql - which becomes a security problem later on.
Artist is an column name. Key should be validated if it contained an valid column name.
I could make a list of strings, containing valid column names to check against.
My question is if there is possible to get this type of information from the database, so I don't have to hand-make these lists?
But I also want to keep the number of heavy and slowing queries down.
My app have like 25 tables now, and I could easily get away with hand-make everything, copy/paste around etc. But I have more projects and this question will be here next time too. And after there again...

Answer 1

Etharo wrote:
Metadata. Then I have to query the database, take the result and use it for validating of input. If my sql only query 1 table, then this is ok. In this case I could do with that. But if the sql query mutliple tables, with sub-selects, unions etc. Then I might have to query all tables first, and even then I might not have what I want.
The best way is of course to run the query, then get the metadata from that query - cause then im 100% sure what columns will be returned, and then I can validate with that.... 1 query is often not that slow. But I might query once to find total number of rows the query return in order to decide if we need to page the result. then query to get the metadata for validating input, then query to get the result... Maybe this is ok -but my head don't like it as an general ok thing to do, but I can't really say why...If you have a gui screen then it needs to correspond to some specific query. It can't be all possible combinations.
So once you know the query you can obtain the meta data using a query that returns no results. Like the following.
select * from mytable wheren 1 = 0
>
Jschell:
I agree to what you say. I don't understood everything you said tho.
Im not sure if you talk about having 1 search field (like google), and you input stuff there that might be in any columns.
I have several search fields in one-to-one relasionship with view column/sql query column.
Then you already know what the field represents. So validate it in the gui and not via the database.
The first is way more advanced since you have to cover any input, any column, any case etc. Pluss add ranking. Lots of work for someone who have done little searchengines.
Latter is simpler, but might also be limiting.Huh?
As an example if you have a call center then the operators are not going to be doing unrestricted searches to find customers. They are going to look using a very limited set of data like the customer name and telephone number.
>
My job is very much like an consulent. They got an app, I shall add a new feature. The app is old and ugly coded. My boss ask how long it takes to make this, I say 2months, he decide 1 month. My dev time for features is rarely above 1 month, and I don't make much new apps.
So I don't have the time to make advanced codegenerator, or spend time to evaluate various frameworks. Bringing an framework into the existing code is actually difficult. But I do want to improve the code, and add good code into the existing app that can be extended without evil pain.
That doesn't jive with your OP. You made the following statement "My app have like 25 tables now, and I could easily get away with hand-make everything,...".
That suggests that you are doing much more than simply updating an existing application.
If you only need to add one new field then you should do only that. You shouldn't be attempting to add a system spanning validation system.
On the other hand if you are in fact adding a validation system, then code generation makes it likely that it would take less time or no more than the same. And it is less likely to introduce bugs.
Learn how to make an code generator? Well I guess thats what I asked help for - point me in the right direction if you could pls. Putting strings together to become code in an logic way is usually manageable, at least for simple querys. Evaluating that the generated code is good/safe - got no good clues...
Learn about frameworks? Got no time. Hope I will get the time, but I won't. The customer must want to spend the money so I can get the time, that won't happen cause an framework does not add features, its only cost saving in terms of dev time, and maintenance time. The customer have no such focus/interest. They got a bit money to spend now and then regularily. i.e. government.
I just want to try code as good as possible so I save myself from errors, painfull rewrites, and dev-time that gets out of proportions because of stupid code. So the question is actually about me trying to improve myself, its just that i don't know how right now.There are two goals.
1. Implement a specific feature in an existing application.
2. Learn a new way to solve problems.
Nothing says that the second will help with the first. They should be addressed separately and your post doesn't make it clear what the first is so it is hard to say how it should be down.
As for the second I already made a suggestion which provides two new ways to solve problems.