Protecting records in database, multithreading in servlets

Question

I have some questions (below) relevant to the following code:
public class theServlet extends HttpServlet
    public void doGet(HttpServletRequest req, HttpServletResponse resp)
     throws ServletException, IOException
         Helper theHelper = new Helper();
         theHelper.setUser(req.getCookies);
         resp.setContentType("text/html");
            PrintWriter out = new PrintWriter(resp.getOutputStream());
            Connection con = null;
         try
               SybDriver sybDriver = (SybDriver) Class.forName("com.sybase.jdbc2.jdbc.SybDriver").newInstance();
               sybDriver.setVersion(com.sybase.jdbcx.SybDriver.VERSION_5);
               DriverManager.registerDriver(sybDriver);
               con = DriverManager.getConnection("jdbc:sybase:Tds:dbsrv1:port/appname", "myuserid", "mypassword");                 if (con != null) {
              if(theHelper.getUserRecord(con, this)) {
                       //do some stuff
                    else { //do some other stuff }
                    con.close();
             }catch(Exception e) { //whatever }
             finally { out.flush(); }
         } //end doGet()
} //end class
public class Helper {
    private String user = "";
    private String field1Val= "";
    private String field2Val= "";
    public boolean setUser(Cookie [] cookies) {
     // method gets the user's userid from a cookie and then:
        user = user_id_from_cookie;
   public boolean getUserRecord(Connection con, theServlet serv){
        StringBuffer sb = new StringBuffer();
        Statement stmt = null;
     try {
         //Try to get the user's info:
            stmt = con.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY );
         StringBuffer sql = new StringBuffer("SELECT field1, field2 FROM UserRecords WHERE user_id = '" + user + "'");
         ResultSet rs = stmt.executeQuery(sql.toString());
            rs.last();
            int nrows = rs.getRow();
            if(nrows < 1) { //user doesn't have an entry in the table yet.
             //First, get result set of records with blank userids:
             sql.replace(0, sql.length(), "SELECT * FROM UserRecords WHERE user_id = '' OR user_id = NULL ORDER BY field1");
          rs = stmt.executeQuery(sql.toString());
                rs.last();
                nrows = rs.getRow();
             if(nrows > 0) {
                 //there ARE some records with null user_id, so assign this user to the first one:
                    rs.first();
                 field1Val = rs.getString("field1").trim();
                 field2Val = rs.getString("field2").trim();
                    //QUESTION: IS IT POSSIBLE THAT TWO USERS/THREADS HAVE THE SAME VALUE OF field1Val AT THIS POINT?
                 sql.replace(0, sql.length(), "UPDATE UserRecords SET user_id = '" + user + "' ");
                 sql.append(" WHERE field1 = '" + field1Val+ "' AND user_id is NULL");
              con.setAutoCommit(false);
              //Trying to use transaction isolation to prevent two users from updating the same record.
              //Does this only work if the users share the connection, con?
              int level = con.getTransactionIsolation();
              try {
                  if(con.getMetaData().supportsTransactionIsolationLevel(con.TRANSACTION_READ_COMMITTED)) {
                      con.setTransactionIsolation(con.TRANSACTION_READ_COMMITTED);
                        //SYNCHRONIZE ON SERVLET INSTANCE?
                  //synchronized(serv){
                        nrows = stmt.executeUpdate(sql.toString());
              }catch(SQLException se) {
                     con.rollback();
                     con.setAutoCommit(true);
                     con.setTransactionIsolation(level);
                     stmt.close();
                     return false;
                 con.commit();
                 con.setAutoCommit(true);
                 con.setTransactionIsolation(level);
                    if(nrows < 1) { //couldn't update the db.
                     stmt.close();
                     return false;
                 else {
                     stmt.close();
                     return true;
             else { //There aren't any unused records; deal with it.
                 stmt.close();
                 return false;
            else { // the user has an entry in the table
                rs.first(); //should only be one record for this userid.
                field1Val = rs.getString("field1").trim();
                field2Val = rs.getString("field2").trim();
                stmt.close();
             return true;
        }catch(SQLException se) {
         //some problem not caught elsewhere
         return false;
   } // end getUserRecord
} // end class HelperI should say that the UserRecords table now contains about 5000 records (this will grow in increments of 5000), many of which have null user_id. If the value is not null, then it contains a userid. A user can have either zero or one entry in the table.
Here are my questions:
1. In the servlet, each thread will have its own instance of Helper and of Connection, correct?
2. I want to ensure that only one thread can update a particular UserRecords table record at a time. In the getUserRecord method, please note the line where field1Val is assigned, just above the capitalized QUESTION comment. Is it possible that two threads could have the same value of field1Val at the same time?
3. When I set the transaction isolation level for connection1, does that prevent other threads that are using other connections to the database from accessing records being updated by the thread using connection1?
4. As you can see, I am considering passing a reference to the servlet instance into the getUserRecords method and synchronizing the update statement on the servlet instance. Will that ensure only one thread at a time can update the record, without using the transaction isolation code?
Thanks in advance for your answer.

Answer 1

1. In the servlet, each thread will have its own
instance of Helper and of Connection, correct?True
2. I want to ensure that only one thread can update a
particular UserRecords table record at a time. In the
getUserRecord method, please note the line where
field1Val is assigned, just above the capitalized
QUESTION comment. Is it possible that two threads
could have the same value of field1Val at the same
time?Yes, use synchronized blocks to avoid problems.
3. When I set the transaction isolation level for
connection1, does that prevent other threads that are
using other connections to the database from accessing
records being updated by the thread using
connection1?Yes
4. As you can see, I am considering passing a
reference to the servlet instance into the
getUserRecords method and synchronizing the update
statement on the servlet instance. Will that ensure
only one thread at a time can update the record,
without using the transaction isolation code?Yes.
http://galileo.spaceports.com/~ibidris/