Replace Quotes, Connection Pooling, and Sun Web Server with MySQL, Oracle

Question

This is code I use to insert data into my MySQL and Oracle databases.
I takes care of quotes and shows use of context, i.e. when you use Sun Web Server's
ConnectionPooling. This code works. Feel free to reply if you have questions on how to set up connection pooling using Sun Web Server 6.1SP - it took quite a long time to learn and I couldn't find much information throughout the web, so I hope this helps...
This is not a question and I am not looking for an answer, but please post comments or suggestions.
dailysun
This is in one class where I have a hashtable containing the
column name / value pairs that I want to enter into my table.
This class simply creates the SQL string from the values in the
hashtable. It then passes that hashtable including the database
name to a class which executes that sql statement (second code
portion).
/* Insert data into sf_parts. Create the column strings from
         * the provided hash table. Be sure to parse out hash elements which
         * are used for the createTemplate process
        StringBuffer values = new StringBuffer();
        StringBuffer fields = new StringBuffer();
        Enumeration keys = fieldHash.keys();
        while(keys.hasMoreElements()){
            Object currentKey = keys.nextElement();
                String fieldValue = (String) fieldHash.get(currentKey);
                if(values.length() >0){
                    values.append(",");
                values.append("'"+fieldValue.replaceAll("'","''")+"'"); // Takes care of quotes and various other special characters!
                if(fields.length() >0){
                    fields.append(",");
                fields.append(currentKey);
        sql = "INSERT INTO myTable (" + fields.toString() + ") VALUES (" + values.toString() + ");";
        String insertResult = caq.getInsertDelete(sql,"myDatabaseName"); // your database name is defined in web.xml and sun-web.xml when you use Sun Web Server's Connection Pooling.
        returnValue += "<br><br><b>Rows inserted into table(myTable): </b>" + insertResult + "<br>\n";
        And, like I describe above, this method executes the sql statement.
     * Takes care of insert, update and delete requests.
     * Must have set both dbName as well as the sql String.
     * Will return number of rows affected as String.
     * @return String Number of rows affected
     * @exception SQLException
     * @exception Exception
    public String getInsertDelete() {
        checkData(); // this simply checks if the variables dbName and sql are not empty ;-)
        InitialContext initContext = null;
        int rv = 0;
        try{
            // Get connection from configured pool
            initContext = new InitialContext();
            source = (DataSource) initContext.lookup("java:comp/env/jdbc/" + dbName); // I have this set up in web.xml and sun-web.xml (I use Sun Web Server 6.1SP which does connection pooling for me)
            conn = source.getConnection();
            if(conn != null){
                stmt = conn.createStatement();
                rv = stmt.executeUpdate(sql);
        }catch (SQLException e){
            // do something
        }catch (Exception e){
            // do something
        }finally{
            try{
                stmt.close();
            }catch(Exception e){
                // do something
            try{
                conn.close();
            }catch(Exception e){
                // do something
            try{
                initContext.close();
            }catch(Exception e){
                // do something
        return rv+"";
    }  

Answer 1

This is code I use to insert data into my MySQL and
Oracle databases.
I takes care of quotes and shows use of context, i.e.
when you use Sun Web Server's
ConnectionPooling. This code works. Feel free to
reply if you have questions on how to set up
connection pooling using Sun Web Server 6.1SP - it
took quite a long time to learn and I couldn't find
much information throughout the web, so I hope this
helps...
This is not a question and I am not looking for an
answer, but please post comments or suggestions.Using prepared statements would mean that you wouldn't have to worry about quotes.
You should be closing the result set.
You are handling all fields as strings. That won't work with time fields and might not work for numeric fields.
Presumably most of your variables are member variables. They should be local variables because that is the scope of the usage.
You must do something with the exceptions.
Hashtables although convienent mean that problems with usage can only be resolved at run time rather than compile time.