Getting Startedwith pureQuery

Chapter 6 – The Client Optimizer: pureQuery for Existing Applications 129
dynamically, replacing SQL statements is not allowed by default, and you must set
pdq.enableDynamicSQLReplacement to TRUE to allow it. For SQL statements that
execute statically, if you cannot sufficiently control access to your pureQueryXml, you can
check your pureQueryXml file before each bind to ensure that it does not contain
replacement statements.
6.10 SQL Literal substitution
Sometimes applications execute SQL statements that contain literal values instead of
parameter markers. For example, if an application searches the EMPLOYEE table for an
employee with an employee number that the user supplies, the application might use string
concatenation to create an SQL statement with a literal value, as shown in Listing 6.11. In
this example, if the user supplied the employee number 000010, then the application
would create the SQL statement shown in Listing 6.12.
String employeeNumber = // value supplied by user
String sql = "SELECT * FROM EMPLOYEE WHERE EMPNO = '" + employeeNumber +
"'";
PreparedStatement preparedStatement = connection.prepareStatement (sql);
ResultSet resultSet = preparedStatement.executeQuery();
Listing 6.11 - An example of code that creates and executes an SQL statement with a
literal value
SELECT * FROM EMPLOYEE WHERE EMPNO = '000010'
Listing 6.12 - The SQL statement that would be created by the code in Listing 6.11 if
the user provided the employee number "000010"
Listing 6.13 shows an example that creates an SQL statement with a parameter, rather
than one with a literal value.
String employeeNumber = // value supplied by user
String sql = "SELECT * FROM EMPLOYEE WHERE EMPNO = ?";
PreparedStatement preparedStatement = connection.prepareStatement (sql);
preparedStatement.setString (employeeNumber);
ResultSet resultSet = preparedStatement.executeQuery();
Listing 6.13 - An example of code that creates and executes an SQL statement with a
parameter
6.10.1 Advantages of parameterized SQL statements
SQL statements that have parameters have many advantages over those that have literal
values. For example, SQL statements that are constructed by concatenation are
vulnerable to SQL injection. In addition, if the user supplies the literal values, then there
can be an enormous number of very similar SQL statements. The large number of distinct
statements can have negative performance impacts, such as by flooding the dynamic
statement cache with statements that are executed only once, and thereby significantly