Getting Startedwith pureQuery

126
Getting Started with pureQuery
-pureQueryXml
"C:\pathOfWorkspace\GettingStartedWithPureQuery\pureQueryFolder\captureFile.pdqxml"
Listing 6.8 - The command to bind the pureQueryXml file with the options that are
listed in Default.bindProps
6.8 Running an application while specifying a pureQueryXml file
When you have a pureQueryXml file that you have configured and possibly used for a bind,
you can direct pureQuery to use it while your application is executing. Use the pureQuery
property pdq.pureQueryXml to specify the path of the pureQueryXml file that pureQuery
should use during execution. The path can indicate the location of the file on the disk, or it
can indicate the location of the file in an archive file that is in the classpath. Use pureQuery
properties to indicate what you want pureQuery to do during execution.
6.8.1 Static execution
Possibly the most common reason for specifying a pureQueryXml file during execution is to
have SQL statements execute statically. You can set the value of the pureQuery property
pdq.executionMode to either STATIC or DYNAMIC. Set it to the value STATIC to direct
pureQuery to execute statically the statements in the pureQueryXml file that have both
statement-set level and statement-level isBindable attributes set to the value true.
You can set the property pdq.allowDynamicSQL to dictate what pureQuery does when
the application attempts to execute statements that are not in the pureQueryXml file. This
property also determines what pureQuery does when the application attempts to execute
statements that are in the pureQueryXml file with an isBindable attribute set to false.
The value TRUE is the default, and it directs pureQuery to execute the statements
dynamically. The value FALSE directs pureQuery to throw exceptions instead of executing
the statements. Some SQL statements cannot be bound. If your application needs to
execute any such statements, you must either set the property pdq.allowDynamicSQL to
the value TRUE or you must leave the property unset.
6.8.2 Captured-only execution
You can use the captured-only feature to restrict the SQL statements that your application
can execute, regardless of whether they are bound in the database. The SQL statements
in your pureQueryXml file provide a whitelist of SQL statements that you allow, and
pureQuery blocks the execution of all other SQL statements. This allows you to improve
the security of applications that contain SQL statements that are not bound. It also helps
you to improve the security of your application in environments where you are not using
static SQL, such as in an environment in which you are using a database other than the
IBM DB2 Database. Set the pureQuery property pdq.capturedOnly to the value TRUE
to use this feature. The default value is FALSE.