PreparedStatement parameter binding

Question

Hello,
I am new to JDBC and java technology. I have experience with SQL, PL/SQL and I am quite shocked, that binding parameters using PreparedStatement class is based on parameter index instead of the parameter name.
It is quite common in PL/SQL to use paramter name to bind a value to it.
E.g. if I use query "select * from foo where id = :id and name = :name" I can bind parameters using dbms_sql.bind_variable(query, "id", 5) dbms_sql.bind_variable(query, "name", "london").
However, in java I jave to bind using parameter index e.g query.setInt(1, 5), query.setString(2, new String("london")). Now the problems are
- what if the sql programmer changes code "select * from foo where id = ? and name = ?" to "select * from foo where name = ? and id = ?"
- think of a quite more complicated query, e.g. query with size of few kB - there can be a parameter repeated many times (id, date range etc) so I need to bind this parameter many times, instead of simple one bind by name
- think of a dynamicaly generated query, where it is seriously complicated to follow the parameter indexes (sql block repeating, dynamicaly generated where clausules etc) and again binding by name is much more easier than indexed binding
So my question is: Do you know of any class that supports binding by name ? Is there any workaround how to solve above mentioned issues ?
And finally, what is the reason to use parameters by index instead of naming, which is I belive more obvious in database programming ?
I am looking forward to your answers.
Kindest regards,
Kamil Poturnaj
Mgr. Kamil Poturnaj, MicroStep-MIS
Ilkovicova 3, 841 04 Bratislava, Slovakia

Answer 1

- what if the sql programmer changes code "select *
from foo where id = ? and name = ?" to "select * from
foo where name = ? and id = ?"Tell him "please stop doing that" :-)
He could also add a third parameter, "address = ?" which would also break it (even if the "?" were spelled ":address").
The SQL statement and the code that binds / extracts values need to be modified in sync.
- think of a quite more complicated query, e.g. query
with size of few kB - there can be a parameter
repeated many times (id, date range etc) so I need to
bind this parameter many times, instead of simple one
bind by nameThough I'm no great fan of vendor-specific 70-style languages, I'd recommend writing a PL/SQL procedure if a query gets very big.
So my question is: Do you know of any class that
supports binding by name ? Is there any workaround how
to solve above mentioned issues ?I don't know of such a package; anyone...?
It should be a nice programming exercise to write one. Something like:
    BindStatement stmt = new BindStatement("select a, :id from foo where id = :id and name = :name");
    stmt.set("name", "John");
    stmt.set("id", 1234);BindStatement would need to locate each occurrence of ":X" and create an SQL string with them replaced with "?"s. It would also need to store the positions where each ":X" occurred, so that when set("id",...) is called, it could do set(1,...); set(2,...); for the underlying statement.
Occurrences of ":X" within strings need to be considered; the easy way is to replace there too.
Unless I'm missing some gotcha, shouldn't take more than a couple of hours to write.
And finally, what is the reason to use parameters by
index instead of naming, which is I belive more
obvious in database programming ?I can only speak from my experience: sql statements within Java code tend to be simple, and the "?" syntax is quite adequate there. Complex statements, if needed, are hidden in PL/SQL. Large systems use beans and automatically generated sql glue. This seems to be rarely a problem.