i have a list of names e.g.:  List&lt;String&gt; names = ... names.add('charles'); ...   and a statement:  PreparedStatement stmt =    conn.prepareStatement('select * from person where name in ( ? )');   how to do the following:  stmt.setParameterList(1,names);   Is there a workaround? can someone explain why this method is missing?  using: java, postgresql, jdbc3
6749
What are the best workarounds for using a SQL IN clause with instances of java.sql.PreparedStatement, which is not supported for multiple values due to SQL injection attack security issues: One ? placeholder represents one value, rather than a list of values.  Consider the following SQL statement:  SELECT my_column FROM my_table where search_column IN (?)   Using preparedStatement.setString( 1, "'A', 'B', 'C'" ); is essentially a non-working attempt at a workaround of the reasons for using ? in the first place.    What workarounds are available?
118306
I'm trying to convert a single-columned subquery into a command-separated VARCHAR-typed list of values.  This is identical to , but for Oracle rather than SQL Server or MySQL.
108771
In the below scenario  i am Accepting the ID of object in the string form : What will be the best way to avoid the SQL injection for ASId.  public static List&lt;AB__c&gt;ABC(string ASId)         records = [select id, name,abc__c,der__f, from AB__c WHERE der__f = :ASId WITH SECURITY ENFORCED ORDER BY AB__c ASC NULLS LAST];
37213
I am trying to run SOQL statement in salesforce.schema tool of FORCE.COM the following query:  Select c.LastName, c.FirstName From Contact c WHERE (FirstName+' '+LastName) In ('Good Name','Bad Name')   It produces an error.   Can I do this kind of things with SOQL ? If yes, then how I can concatenate fields in the query ?
4991
Using SQLite3 with Python 2.5, I'm trying to iterate through a list and pull the weight of an item from the database based on the item's name.  I tried using the "?" parameter substitution suggested to prevent SQL injections but it doesn't work. For example, when I use:  for item in self.inventory_names:     self.cursor.execute("SELECT weight FROM Equipment WHERE name = ?", item)     self.cursor.close()   I get the error:     sqlite3.ProgrammingError: Incorrect number of bindings supplied. The current statement uses 1, and there are 8 supplied.   I believe this is somehow caused by the initial creation of the database; the module I made that actually creates the DB does have 8 bindings.  cursor.execute("""CREATE TABLE Equipment      (id INTEGER PRIMARY KEY,      name TEXT,     price INTEGER,      weight REAL,      info TEXT,      ammo_cap INTEGER,      availability_west TEXT,     availability_east TEXT)""")   However, when I use the less-secure "%s" substitution for each item name, it works just fine. Like so:  for item in self.inventory_names:     self.cursor.execute("SELECT weight FROM Equipment WHERE name = '%s'" % item)     self.cursor.close()   I can't figure out why it thinks I have 8 bindins when I'm only calling one. How can I fix it?
55771
Anyone know how to combine PHP prepared statements with LIKE? i.e.   "SELECT * FROM table WHERE name LIKE %?%";
119920
I'm working on an application for work that is going to query our employee database. The end users want the ability to search based on the standard name/department criteria, but they also want the flexibility to query for all people with the first name of "James" that works in the Health Department. The one thing I want to avoid is to simply have the stored procedure take a list of parameters and generate a SQL statement to execute, since that would open doors to SQL injection at an internal level.  Can this be done?
31050
I need to run a query like:  SELECT p.id, p.name,         (SELECT name            FROM sites s           WHERE s.id = p.site_id) AS site_list   FROM publications p   But I'd like the sub-select to return a comma separated list, instead of a column of data.  Is this even possible, and if so, how?
117983
I am trying to remove duplicate and creating a set and list with non duplicate values related to field ord__c . Trying to minimize the code as far as possible. Let me know if I can handle the same using the below piece of code I am using :   Set &lt; Id &gt; OrId = new Set &lt; Id &gt; ();  Integer j = 0;         while (j &lt; ListR.size())         {           OrId.add(ListR.get(j).Ord__c);           if(OrId.contains(ListR.get(j).Ord__c))           {             ListR.remove(j);           }           else           {             j++;           }         }
26106
I have webservice which is passed an array of ints. I'd like to do the select statement as follows but keep getting errors. Do I need to change the array to a string?  [WebMethod] public MiniEvent[] getAdminEvents(int buildingID, DateTime startDate) {         command.CommandText = @"SELECT id,                             startDateTime, endDateTime From                             tb_bookings WHERE buildingID IN                             (@buildingIDs) AND startDateTime &lt;=                             @fromDate";      SqlParameter buildID = new SqlParameter("@buildingIDs", buildingIDs); }
104197
When i create new User Account and login with that credentials, it gives me this problem if admin doesnt have set thier values yet !!!**  AllotmentList = [select id, Days_Remaining__c from PTO_Allotment__c where Year__c =:year and Employee__c=:EmployeeList[0].id LIMIT 100]; //access only Current user Allotment details                 //to handle Listoutof Bound Exception wrote if-else          if(AllotmentList.size()&gt;0)         {         requests.PTO_Allotment__c=AllotmentList[0].id;         requests.Days_Remaining__c=AllotmentList[0].Days_Remaining__c;         }         else         {             //write a code when AllotmentList is empty ....         }
47691
I've heard that "everyone" is using parameterized SQL queries to protect against SQL injection attacks without having to vailidate every piece of user input.  How do you do this?  Do you get this automatically when using stored procedures?  So my understanding this is non-parameterized:    cmdText = String.Format("SELECT foo FROM bar WHERE baz = '{0}'", fuz)   Would this be parameterized?  cmdText = String.Format("EXEC foo_from_baz '{0}'", fuz)   Or do I need to do somethng more extensive like this in order to protect myself from SQL injection?  With command     .Parameters.Count = 1     .Parameters.Item(0).ParameterName = "@baz"     .Parameters.Item(0).Value = fuz End With   Are there other advantages to using parameterized queries besides the security considerations?  Update:  This great article was linked in one of the questions references by Grotok.
32517
For example I have such query:  Query q = sess.createQuery("from Cat cat"); List cats = q.list();   If I try to make something like this it shows the following warning   Type safety: The expression of type List needs unchecked conversion to conform to List&lt;Cat&gt;   List&lt;Cat&gt; cats = q.list();   Is there a way to avoid it?
38005
Hello I'm trying to use string in SOQL query where clause for multiselect picklist.  I need to get records of CustObj__c where Multipicklist__c fild have 'abc' or 'xyz' values.  String str = '\'abc\',\'xyz\''; for(CustObj__c cust : [Select Id, Name, Multipicklist__c FROM CustObj__c WHERE Multipicklist INCLUDES (:str)]{ somelogic }   However I get no records.  What is wrong in this query?  Ok I tried using list too, here I'm getting all record of all Public Groups where user is assign. and saving those Public Groups names in   List&lt;String&gt; groupIds = new List&lt;String&gt;(); List&lt;String&gt; groupNames = new List&lt;String&gt;();  for(GroupMember gm :[SELECT Id,GroupId,UserOrGroupId FROM GroupMember WHERE UserOrGroupId = :userIds[0]]){             groupIds.add(gm.GroupId);         }         for(Group g :[SELECT ID,Name FROM Group WHERE Id IN :groupIds]){             groupNames.add('\'' + g.Name + '\'');         }  for(CustObj__c cust : [Select Id, Name, Multipicklist__c FROM CustObj__c WHERE Multipicklist INCLUDES (:groupNames)]){ somelogic }   It still not working  I get error in Dev console : Invalid bind expression type of List for column of type String
25709
Let's say I have code like this:  $dbh = new PDO("blahblah");  $stmt = $dbh-&gt;prepare('SELECT * FROM users where username = :username'); $stmt-&gt;execute( array(':username' =&gt; $_REQUEST['username']) );   The PDO documentation says:     The parameters to prepared statements don't need to be quoted; the driver handles it for you.   Is that truly all I need to do to avoid SQL injections?  Is it really that easy?  You can assume MySQL if it makes a difference.  Also, I'm really only curious about the use of prepared statements against SQL injection.  In this context, I don't care about XSS or other possible vulnerabilities.
1992
While working in a Java app, I recently needed to assemble a comma-delimited list of values to pass to another web service without knowing how many elements there would be in advance. The best I could come up with off the top of my head was something like this:  public String appendWithDelimiter( String original, String addition, String delimiter ) {     if ( original.equals( "" ) ) {         return addition;     } else {         return original + delimiter + addition;     } }  String parameterString = ""; if ( condition ) parameterString = appendWithDelimiter( parameterString, "elementName", "," ); if ( anotherCondition ) parameterString = appendWithDelimiter( parameterString, "anotherElementName", "," );   I realize this isn't particularly efficient, since there are strings being created all over the place, but I was going for clarity more than optimization.  In Ruby, I can do something like this instead, which feels much more elegant:  parameterArray = []; parameterArray &lt;&lt; "elementName" if condition; parameterArray &lt;&lt; "anotherElementName" if anotherCondition; parameterString = parameterArray.join(",");   But since Java lacks a join command, I couldn't figure out anything equivalent.  So, what's the best way to do this in Java?
48923
When using JDBC, I often come across constructs like    ResultSet rs = ps.executeQuery(); while (rs.next()) {     int id = rs.getInt(1);     // Some other actions }   I asked myself (and authors of code too) why not to use labels for retrieving column values:    int id = rs.getInt("CUSTOMER_ID");   The best explanation I've heard is something concerning performance. But actually, does it make processing extremely fast? I don't believe so, though I have never performed measurements. Even if retrieving by label would be a bit slower, nevertheless, it provide better readability and flexibility, in my opinion. So could someone give me good explanation of avoiding to retrieve column values by column index instead of column label? What are pros and cons of both approaches (maybe, concerning certain DBMS)?