java - Modifying my methods to use PreparedStatement Objects instead of Statement Objects -

java - Modifying my methods to use PreparedStatement Objects instead of Statement Objects -

how modify code take in preparedstatement objects (instead of statement objects)?

bundle com.cs330; import javax.ws.rs.*; import java.sql.connection; import java.sql.drivermanager; import java.sql.resultset; import java.sql.sqlexception; import java.sql.statement; @path("ws2") public class ingredientservices @path("/ingredients") @get @produces("text/plain") public string getingredients() throws sqlexception, classnotfoundexception { string connectstr="jdbc:mysql://localhost:3306/fooddb"; //database username string username="root"; //database password string password="csci330pass"; /* driver java class used accessing * particular database. must download * database vendor. */ string driver="com.mysql.jdbc.driver"; class.forname(driver); //creates connection object database connection con = drivermanager.getconnection(connectstr, username, password); /* creates statement object executed on * attached database. */ statement stmt = con.createstatement(); /* executes database query , returns results * resultset object. */ resultset rs = stmt.executequery("select id, name, category ingredient"); /* snippet shows how parse resultset object. * basically, loop through object sort of * linkedlist, , utilize getx methods info * current row. each time phone call rs.next() * advances next row returned. * result variable used compile * info 1 string. */ string result = ""; while (rs.next()) { int theid = rs.getint("id"); string thename = rs.getstring("name"); string thecategory = rs.getstring("category"); result += "id: "+theid+ " , name: "+thename + "("+thecategory+")" + "\n" + "\n"; } homecoming result; }//end @path("/ingredients/{id}") @get @produces("text/plain") public string getingredientbyid(@pathparam("id") string theid) throws sqlexception, classnotfoundexception { int intid = 0; seek { intid = integer.parseint(theid); } grab (numberformatexception fail) { intid = 1; }//obtaining ingredient database string connectstr="jdbc:mysql://localhost:3306/fooddb"; string username="root"; string password="csci330pass"; string driver="com.mysql.jdbc.driver"; class.forname(driver); connection con = drivermanager.getconnection(connectstr, username, password); statement stmt = con.createstatement(); resultset rs = stmt.executequery("select id, name, category ingredient id=" +intid); string result = ""; while (rs.next()) { int theid2 = rs.getint("id"); string thename2 = rs.getstring("name"); string thecategory = rs.getstring("category"); result += "id: "+theid2+ " , name: "+thename2 + "("+thecategory+")" + "\n" + "\n"; } homecoming result; }//end method @path("/ingredients/name") @get @produces("text/plain") public string getingredientbyname(@queryparam("name") string thename) throws sqlexception, classnotfoundexception { //obtaining ingredient database string connectstr="jdbc:mysql://localhost:3306/fooddb"; string username="root"; string password="csci330pass"; string driver="com.mysql.jdbc.driver"; class.forname(driver); connection con = drivermanager.getconnection(connectstr, username, password); statement stmt = con.createstatement(); resultset rs = stmt.executequery("select id, name, category ingredient name='" + thename + "'"); string result = ""; while (rs.next()) { int theid3 = rs.getint("id"); string thename3 = rs.getstring("name"); string thecategory = rs.getstring("category"); result += "id: "+theid3+ " , name: "+thename3 + "("+thecategory+")" + "\n" + "\n"; } homecoming result; }//end method }//end code

i know fact not simple changing object variable statement preparedstatement... that's why i'm asking suggestions here. give thanks you.

few steps:

change type statement preparedstatement. store queries in string variables. place should utilize dynamic value (e.g. places concatenate string) parameters query, replace these variables ?. create preparedstatement using connection#preparestatement rather using connection.createstatement. set parameters in preparedstatement using setxxx methods. execute statement using executequery method.

an illustration covered in preparedstatement javadoc.

this how can alter getingredientbyid method next steps above:

connection con = drivermanager.getconnection(connectstr, username, password); //from "select id, name, category ingredient id=" + intid //check usage of ? instead of intid string sql = "select id, name, category ingredient id = ?"; preparedstatement pstmt = con.preparestatement(sql); //setting variable in preparedstatement pstmt.setint(1, intid); resultset rs = pstmt.executequery(); string result = ""; while (rs.next()) { //consume data... }

this how can alter getingredientbyname method next steps above:

connection con = drivermanager.getconnection(connectstr, username, password); //? don't need escape using ' around //? equals parameter, why using preparedstatement more safe //it help avoid sql injection attacks string sql = "select id, name, category ingredient name = ?"; preparedstatement pstmt = con.preparestatement(sql); pstmt.setstring(1, thename); resultset rs = pstmt.executequery(); string result = ""; while (rs.next()) { //consume data... }

do similar necessary methods in project.

java sql api jdbc prepared-statement