These notes add to the JDBC discussion your textbook.

Transcription

1 jdbc.txt Fri Dec 09 18:27: Extra JDBC Notes Owen Kaser 21 February 2015 These notes add to the JDBC discussion your textbook.

2 jdbc.txt Fri Dec 09 18:27: JDBC History Earlier, there was ODBC: Open Database Connectivity a middleware library so that C programs could talk to SQL databases. Need a database-vendor-specific "Driver", a piece of software that talks to the SQL database in its own dialect. JDBC is the Java-ization of ODBC. They are similar enough that ODBC <---> JDBC compatability modules exist, so that Java can talk to a database that has only an ODBC driver.

3 jdbc.txt Fri Dec 09 18:27: More JDBC History JDBC version 1.2 from Version when I taught a database course last (Fall 1998)...Java was new, shiny and **simple** then JDBC 2.1 : JDBC 4.0 : 2006 JDBC 4.2 : part of Java 8, released 2014.

4 jdbc.txt Fri Dec 09 18:27: Key JDBC Classes Driver : talks to SQL database. Specific to Oracle, MySQL, SQLServer, etc. Connection : to the SQL database. Statement / PreparedStatement / Callable Statement: How you send something to the database ResultSet : what queries return back to you. You iterate over it.

5 jdbc.txt Fri Dec 09 18:27: JDBC Types Java has its types (int, float, String,...) SQL has its types. (And they vary some by vendor) JDBC types given by constant int codes defined in java.sql.types. Some of these types are BIGINT, CHAR, CLOB, DATE, DOUBLE, FLOAT, INTEGER, NCHAR, NULL, NUMERIC, NVARCHAR, VARCHAR, SMALLINT, TIMESTAMP. And many more. JDBC will usually try to do type conversions for you. Eg, you can read any value out of the database as a String, even if it isn t defined as a CHAR or VARCHAR there. But sometimes these auto type conversions give nasty surprises.

6 jdbc.txt Fri Dec 09 18:27: "JDBC-Classic" The code shown in the textbook is the traditional style. You may see old code written this way. You may wish to write code this way, to run on systems with an old version of Java. A magic incantation is needed to get driver set up. (And driver must be on Java classpath).

7 jdbc.txt Fri Dec 09 18:27: JDBC Classic example import java.sql.*;... try{ // incantation to load & register driver Class.forName("oracle.jdbc.driver.OracleDriver"); } catch (ClassNotFoundException e) {... } String url="jdbc:oracle:thin:@localhost:1521/pdb1"; String usr="bigpvfc", pwd="pvfc"; Connection c=drivermanager.getconnection(url,usr,pwd); Statement s=c.createstatement(); ResultSet r=s.executequery("select * from T"); while (r.next()) System.out.println("first col value is "+ r.getstring(1)); // by position of column // or r.getstring("foo") // by name of column 1 r.close(); s.close(); c.close();

8 jdbc.txt Fri Dec 09 18:27: JDBC Classic, updating/inserting/ddl import java.sql.*;... as before... Statement s = c.createstatement(); s.executeupdate("create table T(foo varchar2(20)," + "bar varchar2(20))"); // not needed: s = c.createstatement(); s.executeupdate("insert into T(foo,bar) " + "values( somefoovalue,123)");

9 jdbc.txt Fri Dec 09 18:27: More on ResultSet ResultSet r=s.executequery("select * from T"); while (r.next()) System.out.println("first col value is "+ r.getstring(1)); // by position of column But if the first column stored a DATE, it might be better to use r.getdate(), which returns a java.sql.date object *not a java.util.date* other getters: gettimestamp -- returns a java.util.timestamp getbigdecimal -- returns a java.math.bigdecimal (use with SQL NUMERIC) getint -- returns an int... and many more, see java.sql.resultset

10 jdbc.txt Fri Dec 09 18:27: JDBC Classic, "prepared statements" A prepared statement is an SQL statement/query with parameters, given by?s. It can be "compiled" once by JDBC/the database, and then parameters filled in many different times. params filled in with setxxx (setint, setstring...) Indeed, once compiled, maybe only the parameters have to be sent across network. Can protect against SQL injection attacks. JDBC PreparedStatement extends from Statement.

11 jdbc.txt Fri Dec 09 18:27: Prepared Statement example import java.sql.*;... as before... PreparedStatement ps = c.preparestatement( "update T set foo =? where bar like?");... ps.setstring(1,"hello"); ps.setstring(2,"world"); ps.executeupdate();... Note: we could also make a prepared statement that is a query.

12 jdbc.txt Fri Dec 09 18:27: Callable Statements Similar to prepared statements, except that they are used to invoke SQL procedures and functions. Since these can have OUT parameters, you have to do something special: "register" them - declare what JDBC types to associate with the OUT params. JDBC CallableStatement extends from Statement.

13 jdbc.txt Fri Dec 09 18:27: Callable Statement Example import java.sql.*;... as before... CallableStatement cs = c.preparecall( "{call kaserproc(?,?,?)}");... cs.setstring(1,"hello"); cs.registeroutparameter(2, Types.INTEGER); cs.registeroutparameter(3, Types.DATE); cs.executeupdate(); int firstoutparam = cs.getint(2); if (cs.wasnull() ) firstoutparam = -999; Date sndoutparam = cs.getdate(3);

14 jdbc.txt Fri Dec 09 18:27: "New JDBC" (Java version 7+, JDBC 4.0 for some) Use "connection pooling" and DataSource Use try-with-resources no need to put in the forclass magic

15 jdbc.txt Fri Dec 09 18:27: javax.sql.datasource (note: javax, not java) This interface is implemented by modern JDBC drivers. Required methods are Connection getconnection() Connection getconnection(string user, String passwd) It is implemented, for instance, by class oracle.jdbc.pool.oracledatasource OracleDataSource ods = new OracleDataSource(); ods.seturl("jdbc:oracle:thin:@localhost:1521/pdb1"); Connection c = ods.getconnection("bigpvfc","pvfc");...

16 jdbc.txt Fri Dec 09 18:27: Connection Pooling Connections are expensive (slow to set up, consume many resources on both client and server) "Connection Pooling" recycles perfectly good connections instead of creating and destroying them. Can be much faster. Requires a little more code and adds complexity to application. Still, "real world" systems may want to use.

17 jdbc.txt Fri Dec 09 18:27: Oracle UCP Connection Pooling (just for interest) (modified from pdf) not installed on our Oracle VM. import oracle.ucp.jdbc.*;... PoolDataSource p = PoolDataSourceFactory.getPoolDataSource(); p.setconnectionfactoryclassname("oracle.jdbc.pool."+ "OracleDataSource"); p.seturl("jdb.oracle:thin:@//localhost:1521/pdb1"); p.setuser("bigpvfc"); p.setpassword("pvfc"); // get connection from existing pool, or create // a brand new one for the pool, if pool empty Connection c = p.getconnection();... use the connection as usual... c.close()

18 jdbc.txt Fri Dec 09 18:27: Releasing resources In Java, certain kinds of resources can be tied up. Can run out of open files - or open JDBC connections. Run out well before memory runs short and a garbage collection runs. Morals of the story: 1. Always close resource-intensive things like Connection, Statement, ResultSet (and BufferedReader) when you re done with them. 2. Don t actually plan to use lots of them at once 3. Close *even if an exception is thrown* Use the "finally" in a "try-catch-finally" for this.

19 jdbc.txt Fri Dec 09 18:27: Traditional Try-Catch-Finally set up OracleDataSource ds... Connection c=null; Statement s=null; try { c = ds.getconnection("bigpvfc","pvfc"); s = c.createstatement();... attempt something with s... } catch (Exception e){...some error handling...} finally { if ( s!= null) s.close(); if ( c!= null) c.close(); }

20 jdbc.txt Fri Dec 09 18:27: Try-With-Resources (Java 7 and up) set up Oracle ds... try(connection c = ds.getconnection("bigpvc","pvfc"); Statement s = c.createstatement()) {... attempt something with s... } This will automatically close the Connection and Statement, regardless of whether an exception is thrown.

21 jdbc.txt Fri Dec 09 18:27: SQL injection attacks It is *very* unwise to construct a query by string manipulations if user-input strings form part of the query. Eg. String userinput;... a web form got the user to enter her name into a chess tournament registration web page. Result is in userinput. String command = "insert into registration_t(user_name) values ( " + userinput + " )"; c.executeupdate(command); // works great when user gives name of Nancy // But when C. R. Acker enters the "name" // ); drop table registration_t; -- // then bad things might happen... // if you "sanitize" names to not contain funny // characters, maybe you are safe. Poor O Brien. // Better to use prepared statements.