prepared-statement

prepared statements JBoss MySQL

I have a question regarding using Prepared Statements with JBoss and MySQL. DataSource is configured on JBoss side. Here is the config file: x jdbc:mysql://x com.mysql.jdbc.Driver x x 10 20 5000 5 org.jboss.resource.adapter.jdbc.vendor.MySQLExceptionSorter org.jboss.resource.adapter....

Why is this Java PreparedStatement throwing ArrayIndexOutOfBoundsException 0 with parameterIndex = 1?

The following method, when called with something like String val = getCell("SELECT col FROM table WHERE LIKE(other_col,'?')", new String[]{"value"}); (this is SQLite), throws a java.lang.ArrayIndexOutOfBoundsException: 0 at org.sqlite.PrepStmt.batch(PrepStmt.java:131). Can anyone take pity on my poor bumbling here and help me with why? ...

mySQL search in multiple Rows ...

I have a Table : | USERNAME | FORNAME | SURNAME | TELNUMBER | ZIPCODE .... and i want to search username forename and surname in 1 query / statement .. and i dont want multiple lines .. like.. lets say .. username : maria33 forname : maria so this should be 1 row .. when i search mar% and not 2 ! ...

Looking for a simple mySQLi class example with descriptions

Hi, I am looking for an example of a simple, but functional example of a class extending the mySQLi class in PHP5. I am interested in stored procedures also. Basically what I need is an example of a practical and usable class. I learn best by example and unfortunately I have been unable to find any site or book that seems to have a reall...

SQLException: JZ0S4: Cannot execute an empty (zero-length) query. on a Prepared Statement

Heres a class executing PreparedStatements on a Connection. public class doSomething { private PreparedStatement ps; public setPS (Connection conn) throws SQLException { String sql = "select * from table where id = ?"; ps = conn.prepareStatement(sql); } public void runSomething(String var){ ps....

Cursor-fetched variable in prepared statement within a stored procedure?

Hullo, Can any help me shed some light on what's going on when I try to prepare a statement from a string that contains a cursor-fetched variable? Below is the procedure that I'm trying to create. When I create it without the prepared statement, and replace those three lines with SELECT @export_sql_stmt, the output verifies that the S...

mysqli_real_escape_string AND prepared statements?

Should be a simple enough question: If I am using mysqli prepared statements, do I still need to use mysqli_real_escape_string() as well? Is this necessary, or a good idea? Thanks, Nico ...

Should prepared statements be deallocated when used inside stored procedures?

Hi! When using prepared statements inside stored procedures, should they be deallocated at the end of the procedure or not, or does it not matter, and why? Some code to explain: CREATE PROCEDURE getCompanyByName (IN name VARCHAR(100)) NOT DETERMINISTIC BEGIN PREPARE gcbnStatement FROM 'SELECT * FROM Companies WHERE name=? LIMIT 1'; ...

How to write prepared statements for SQLite in iPhone

How to write prepared statements for SQLite in iPhone? Is it possible to do SQL Injection in iPhone apps that use sqlite db? ...

Php: check if an pg_prepare prepared statement already exist

Hi guys, i create my prepared statement as: pg_prepare('stm_name', 'SELECT ...'); Today, i had a problem (calling twice a function for mistake) when declaring a prepared statement with the same name twice: Warning: pg_prepare() [function.pg-prepare]: Query failed: ERROR: prepared statement "insert_av" already exists in xxx on line 2...

Prepared Statement Failing

I'm using a prepared statment that should (using SQL & JDBC) insert data into a dataTable. I am using one that deletes data that works fine, but the insert one is not inserting any data into the data table and does not produce an error or warning. What could cause a prepared statement to fail in this way? Could inserting a null value int...

Prepared Statement Failing (With an Error Message!)

I am getting this error when trying to insert data into a data table Error Saving data. [Microsoft][ODBC Microsoft Access Driver]COUNT field incorrect I looked at the appropriate data table and there does not exist a field called COUNT either hidden or not hidden. Is this some SQL terminology that I should be familiar with? An Extens...

How to get the status of a Java PreparedStatement.executeQuery(..)

I have a SQL query running using something like this: PreparedStatement pstmt = dbConn.prepareStatement(sqlQuery); ResultSet rs = null; .. .. Set parms here .. .. rs = pstmt.executeQuery(); It works fine when I use a local database, but I have to test on this remote one since it has a lot more data. But since it's remote, it is taking...

Using Prepared Statements to set Table Name

Im trying to use prepared statements to set a table name to select data from but i keep getting an error when i execute the query. The error and sample code is displayed below. [Microsoft][ODBC Microsoft Access Driver] Parameter 'Pa_RaM000' specified where a table name is required. private String query1 = "SELECT plantID, edrman, pl...

What would happen if I set null in prepared statement with varchar always?

I have this method to insert data using jdbc that will insert the value according to the java type. Something like this: Object o = map.get( key ); if( o == null ) { // setNull( index ); } else if( o instanceof String ) { // setString( index, (String) o ); } else if( o instanceof Timestamp ) { // setTimestampt( index, ( Ti...

Mysqli Prepare Statement - Returning False, but Why?

I have a function that generates a prepared INSERT statement based on an associative array of column names and values to be inserted into that column and a table name (a simple string): function insert ($param, $table) { $sqlString = "INSERT INTO $table (".implode(', ',array_keys($param)).') VALUES ('.str_repeat('?, ', (count($p...

Recurring SQL Queries

What is considered best practice for executing recurring SQL queries? My understanding is to use a parameterized query and turn it into a prepared statement upon first execution. What if this query needs to be executed by multiple threads? Will I need to create a prepared statement for each type of query for each thread? Or is the par...

Preventing SQL injection without prepared statements (JDBC)

I have a database log appender that inserts a variable number of log lines into the database every once in a while. I'd like to create an SQL statement in a way that prevents SQL injection, but not using server-side prepared statements (because I have a variable number of rows in every select, caching them won't help but might hurt perf...

Correct usage of MySQL LOAD_FILE()

Hi all, I apologize if this is a dense question, but I'm having a bit of trouble using MYSQL LOAD_FILE() in conjunction with prepared statements in order to upload an image BLOB. As a result, I'm having to resort to using to separate queries, one to prepare a statement for details, and another, which doesn't prepare the statement to ins...

Prepared Statements in a Database class.

The Problem So I'm writing my web based application and it dawns on me "Durr, your stuff is wide open to SQL injection and whatnot! Rewrite db class!" I'm currently re-writing my $db class and I am having a significant amount of trouble understanding how I'm supposed to implement prepared statements. Previously... I used to use somet...