JDBC Inner Query Code Needed

Question

Hi
I have a table called Sale
contains a column called quantity_Available_For_Sale numeric(18,0)
Another table called Withdrawal_Operations contains a column called quantity_withdrawan numeric(18,0)
I need a jdbc code that add quantity_withdrawan value when inserted in the Withdrawal_Operations to the sum of the values of quantity_Available_for_Sale field
this is my trial code
  String sql= "update Sale  set  Item_code ='"+jTextField7.getText()+"',quantity_Available_for_Sale='"+jTextField10.getText()+"SELECT SUM"+""+quantity_Available_for_Sale+""+" FROM "+'Sale'+"+"'WHERE  withdrawal_id='"+jTextField12.getText()+"'";It generates two errors
unclosed character literal.
not a statement.
thanks
Edited by: VANPERSIE on May 7, 2011 10:50 PM

Answer 1

Hi,
This is what you currently have, I think. All I have done is some formatting in order to be able to read it.
String sql = "update Sale set  Item_code ='"   +
             jTextField7.getText()             +
             "',quantity_Available_for_Sale='" +
             jTextField10.getText()            +
             "'SELECT SUM'"                    +
             ""                                +
             "("                               +
             quantity_Available_for_Sale       +
             ")"                               +
             ""                                +
             " FROM "                          +
             Sale                              +
             ""                                +
             "' WHERE  withdrawal_id='"        +
             jTextField12.getText()            +
Statement stmt = con.createStatement(sql);That approach is wrong for several reasons, some being
1. Each time you concatenate a string together, it will be a brand new SQL statement for the server to hard parse.
Not only is this inefficiant, it breaks your SQL cache, causes latching which is definite resource.
Always use bind variables when dealing with databases.
2. You are subject to SQL injection. If your text fields contains SQL or parts of SQL, malicious users could take advantage of that.
3. Your statement is not type safe, and you need to clutter up with single quotes to turn strings into literals.
With this kind of code you are at sub-zero level of writing database applications.
A better approach would be to use PreparedStatement as suggested.
In your case something like:
String sql = "update Sale set  Item_code =?"   +
             ",quantity_Available_for_Sale="   +
             "SELECT SUM"                      +
             ""                                +
             "("                               +
             quantity_Available_for_Sale       +
             ")"                               +
             ""                                +
             " FROM "                          +
             Sale                              +
             ""                                +
             " WHERE  withdrawal_id=?";
PreparedStatement pstmt = con.prepareStatement(sql);
pstmt.setString(1, jTextField10.getText());
pstmt.setString(2, jTextField12.getText());This should take of the three points listed above.
In my opinion you are now at level 1 of writing database applications.
You still have some problems. Above sql, is not SQL, it is nothing but a Java String.
You will struggle to make it into valid SQL, probably by using a cumbersome trial and error process.
And this is even quite simple SQL.
In your case you seem to be pulling data from the front end, and use this directly in the data access layer.
So, you have no POJO layer (I am not saying that you should have).
This makes the SQL a perfect candidate for what you already mentioned yourself, stored procedures.
Using a stored procedure, you have something like this:
String sql = "{call sales_pck.set_quant_avail(?,?)}";
CallableStatement cstmt = con.prepareCall(sql);
cstmt.setString(1, jTextField10.getText());
cstmt.setString(2, jTextField12.getText());Looks much more appealing doesn't it?
- And not much room for SQL syntax errors.
You will of course have to implement that stored procedure. Something many Java developers do not like to do.
Don't know why - to me it smells like technology anxiety.
There is nothing wrong about stored procedures, and nothing old school about them. In your case it even seems like a sensible thing to do.
The first advantage about it, is that you will get to work in a layer (The database) that actually knows SQL.
Here's an attempt to implement your stored, implmented by using a PL/SQL package:
create or replace package sales_pck as
  procedure set_quant_aval (
    p_item_code        in sale.item_code%type,
    p_with_drawal_id   in sale.withdrawal_id%type
end sales_pck;
create or replace package body sales_pck as
  procedure set_quant_aval (
    p_item_code        in sale.item_code%type,
    p_with_drawal_id   in sale.withdrawal_id%type
  ) is
  begin
    update sale
    set    item_code = p_item_code,
           quantity_available =
           select sum (quantity_available_for_sale)
              from   sale
           where  withdrawal_id = p_with_drawal_id;
  end set_quant_aval;
end sales_pck;
/Doing this, you will soon realize that you are not quite there.
You SQL is syntactically wrong (At least in Oracle).
But you are now in the right environment to fix it.
It is probably also semantically wrong, it gives little meaning, and you are probably facing mutating table
(At least in Oracle and other databases supporting read consistency)
Note on syntax errors. You probably mean
    update sale
    set    item_code = p_item_code,
           quantity_available =
             (select sum (quantity_available_for_sale)
              from   sale
              where  withdrawal_id = p_with_drawal_id);Or
    update sale
    set    item_code = p_item_code,
           quantity_available =
             (select sum (quantity_available_for_sale)
              from   sale)
    where  withdrawal_id = p_with_drawal_id;I can't say which, they seem equally wrong.
This is what you should do:
1. Write a correct update statment in a query tool of your choice.
2. Put that statment inside a stored procedure
3. Test that procedure from a query tool
4. Implement the procedure call in your application
5. Test it.
Conclusion:
If you intend to do any (handwritten) SQL in your application, the goal is:
- write as little as you can in the Java layer
- write as much as possible in the database layer
One way of achieving this, is by utilizing stored procedures.
Regards
Peter