CSE 135. Three-Tier Architecture. Applications Utilizing Databases. Browser. App. Server. Database. Server

Transcription

1 CSE 135 Applications Utilizing Databases Three-Tier Architecture Any PC HTTP Requests Browser HTML Server 2 App Server JDBC Requests JSPs Tuples Server 1 Database Server 2 Students example: Create a jdbc-examples database in your db, then create this schema CREATE TABLE students ( ID SERIAL PRIMARY KEY, pid INTEGER, first_name TEXT, middle_name TEXT, last_name TEXT ); INSERT INTO students (pid, first_name, middle_name, last_name) VALUES ( , 'Mary', '', 'Doe'); INSERT INTO students (pid, first_name, middle_name, last_name) values ( , 'John', 'T', 'Smith'); 3 1

2 Accessing the students table with JDBC import java.sql.*; class JdbcTest { public static void main (String args []) throws SQLException { // Registering Postgresql JDBC driver Class.forName("org.postgresql.Driver"); // Open a connection to the database Connection conn = DriverManager.getConnection( "jdbc:postgresql://localhost/jdbc-examples?" + "user=postgres&password=postgres"); 5 JDBC (cont d) // Query the student PIDs Statement stmt = conn.createstatement(); ResultSet rset = stmt.executequery("select pid FROM students"); // Print out the PID (1st attribute) while (rset.next ()) System.out.println (rset.getint(1)); //close the result set, statement, and connection rset.close(); stmt.close(); conn.close(); 6 Updates stmt.executeupdate( UPDATE students SET first_name = John WHERE ID = 1 ); 7 2

3 PreparedStatement Object If you want to execute a Statement many times + defend against SQL injection attack use a PreparedStatement object instead: PreparedStatement pstmt = conn.preparestatement( "UPDATE students SET first_name =? " + "WHERE ID =?"); pstmt.setstring(1, John"); pstmt.setint(2, 1); 8 PreparedStatement Object (cont d) The following two code fragments accomplish the same thing: String updatestr = "UPDATE students SET first_name = John " + "WHERE ID = 1"; stmt.executeupdate(updatestr); PreparedStatement pstmt = conn.preparestatement( "UPDATE students SET first_name =? " + "WHERE ID =?"); pstmt.setstring(1, John"); pstmt.setint(2, 1); updatesales.executeupdate(): 9 ResultSet Object int getint(int columnindex) Retrieves the value of the designated column in the current row of a ResultSet object as an int Java type int getint(string columnname) String getstring(int columnindex) String getstring(string columnname) 10 3

4 Using Transactions When a connection is created, it is in AutoCommit mode, that is, each individual SQL statement is treated as a transaction and will be automatically committed right after it is executed conn.setautocommit(false); <transaction> conn.commit(); conn.setautocommit(true); You can omit if you do not wish to switch back to autocommit mode. Then this point becomes the start of a new transaction 11 Why use transactions Example Requirement: Students 2 and 3 either enroll in the class 2 together or they do not enroll in it at all conn.setautocommit(false); PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?,?) ); pstmt.setint(1, 2); pstmt.setint(2, 2); pstmt.setint(1, 3); pstmt.setint(2, 2) conn.commit(); 12 Why use transactions? Automatic Recovery protects from Crash Effects conn.setautocommit(false); PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?,?) ); pstmt.setint(1, 2); pstmt.setint(2, 2); pstmt.setint(1, 3); Crash pstmt.setint(2, 2) conn.commit(); 13 4

5 Covered and not-covered Crash Cases Covered (the typical crash): CPU halt Loss of RAM memory state Crash of database server Not Covered Loss of disk state 14 Recovery of non-committed transactions guarantees that the executed part has no effect conn.setautocommit(false); PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?,?) ); pstmt.setint(1, 2); pstmt.setint(2, 2); pstmt.setint(1, 3); Crash pstmt.setint(2, 2) conn.commit(); 15 Recovery of committed transactions guarantees that the executed part is definitely in the database conn.setautocommit(false); PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?,?) ); pstmt.setint(1, 2); pstmt.setint(2, 2); pstmt.setint(1, 3); pstmt.setint(2, 2) Crash conn.commit();

6 Why use transactions? Bugs due to Concurrent Processes Classes have enrollment limit of 100 students. See what can happen by two processes running in parallel, without using concurrency control: First process enrolls student 1 in class 2. Second process enrolls student 2 in class 2. ResultSet rset = stmt.executequery( "SELECT count(*) FROM enrollment WHERE class=2"); if (rset.next ()) { if (rset.getint(1) < 100) ResultSet rset = stmt.executequery( "SELECT count(*) FROM enrollment WHERE class=2"); if (rset.next ()) { if (rset.getint(1) < 100) { PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?, 2) ); pstmt.setint(1, 1); else // enrollment limit has been reached { PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?, 2) ); pstmt.setint(1, 2); else // enrollment limit has been reached 17 Concurrency Control guarantees that the concurrent computation is limited to computations equivalent to a serial execution of the transactions Concurrency control methods employ lock systems and/or transaction abortions and statement exceptions to avoid malicious concurrency scenarios conn.setautocommit(false); ResultSet rset = stmt.executequery( "SELECT count(*) FROM enrollment WHERE class=2"); if (rset.next ()) { if (rset.getint(1) < 100) conn.setautocommit(false); ResultSet rset = stmt.executequery( "SELECT count(*) FROM enrollment WHERE class=2"); if (rset.next ()) { if (rset.getint(1) < 100) ABORT { PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?, 2) ); pstmt.setint(1, 1); else // enrollment limit has been reached conn.commit { PreparedStatement pstmt = conn.preparestatement( INSERT INTO enrollment (student, class) VALUES (?, 2) ); pstmt.setint(1, 2); else // enrollment limit has been reached 18 Retrieving Exceptions JDBC lets you catch the exceptions generated by your DBMS try { // Code that could generate a SQLException catch (SQLException e) { // Either handle exception here // or propagate it upwards with the original cause throw new RuntimeException(e); 19 6

7 Retrieving Exceptions (cont d) Release resources even if an exception if thrown try{ catch (SQLException e) { finally { // release resources in reverse-order of creation if (rs!= null) { try { rs.close(); catch (SQLException e) { // Ignore rs = null; if (pstmt!= null) { if (conn!= null) { 20 Back to the Students Example 21 1 st Attempt: only reports students no forms 22 7

8 1 st Attempt; Split apart menus, advertisements, etc Menu HTML Code <b>data Entry Menu</b> <ul> <li><a href= students.jsp">students<a></li> <li><a href="classes.jsp">classes<a></li> <li><a href= enrollment.jsp">enrollment<a></li> </ul> 23 1 st Attempt JSP Code <html> <body><table><tr> <td><jsp:include page="menu.html /></td> <td> <Open Connection Code> <Statement Code> <Presentation Code> <Close Connection Code> </td> </tr></table></body> </html> 24 1 st Attempt Open Connection Code <%-- Import the java.sql package --%> <%@ page import="java.sql.*" %> <% <variable declarations and initializations> try { // Registering Postgresql JDBC driver Class.forName("org.postgresql.Driver"); // Open a connection to the database conn = DriverManager.getConnection( "jdbc:postgresql://localhost/jdbc-examples?" + "user=postgres&password=postgres"); %> 25 8

9 1 st Attempt Statement Code <% // Create the statement stmt = conn.createstatement(); // Use the statement to SELECT the students // FROM the students table. rs = stmt.executequery("select * FROM students"); %> 26 1 st Attempt Presentation Code <table> <tr> <th>id</th> <th>pid</th> <th>first Name</th> <th>middle Name</th> <th>last Name</th> </tr> <%-- Iterate over the ResultSet --%> <% while ( rs.next() ) { %> <Iteration Code> <% %> </table> 27 1 st Attempt Iteration Code <tr> <%-- Get the id--%> <td><%=rs.getint( ID")%></td> <%-- Get the pid --%> <td><%=rs.getint( pid")%></td> <%-- Get the first name --%> <td><%=rs.getstring("first_name")%></td> <%-- Get the middle name --%> <td><%=rs.getstring("middle_name")%></td> <%-- Get the last name --%> <td><%=rs.getstring("last_name")%></td> </tr> 28 9

10 1 st Attempt Close Connection Code <% // Close the ResultSet rs.close(); // Close the Statement statement.close(); // Close the Connection conn.close(); catch (SQLException e) { <Exception handling> %> 29 2 nd Attempt: Insertion form included 30 Model 1 programming Database accessing code If request to insert student perform SQL INSERT If request to delete student perform SQL UPDATE If request to update student perform SQL DELETE HTML-producing part of JSP INSERT STUDENT FORM UPDATE STUDENT FORMS DELETE STUDENT FORMS

11 2 nd Attempt JSP Code <html> <body><table><tr> <td><jsp:include page="menu.html /></td> <td> <Open Connection Code> <Insertion Code> <Statement Code> <Presentation Code> <Close Connection Code> </td> </tr></table></body> </html> 32 2 nd Attempt Presentation Code <table> <tr> <th>id</th> <th>pid</th> <th>first Name</th> <th>middle Name</th> <th>last Name</th> </tr> <Insert Form Code> <%-- Iterate over the ResultSet --%> <% while ( rs.next() ) { %> <Iteration Code> <% %> </table> 33 2 nd Attempt Insert Form Code <tr> <form action="students.jsp" method= POST"> <input type="hidden" name="action" value="insert"/> <th> </th> <th><input value="" name= pid" size="10"/></th> <th><input value="" name="first" size="15"/></th> <th><input value="" name="middle" size="15"/></th> <th><input value="" name="last" size="15"/></th> <th><input type="submit" value="insert"/></th> </form> </tr> 34 11

12 2 nd Attempt Insertion Code // Check if an insertion is requested String action = request.getparameter("action"); if (action!= null && action.equals("insert")) { // Create the prepared statement to INSERT student values pstmt = conn.preparestatement( "INSERT INTO students (pid, first_name, middle_name, last_name) VALUES (?,?,?,?)"); pstmt.setint(1,integer.parseint(request.getparameter( pid"))); int rowcount = 35 3 rd Attempt 36 3 rd Attempt JSP Code <html><body><table><tr> <td><jsp:include page="menu.html /></td> <td> <Open Connection Code> <Insertion Code> <Update Code> <Delete Code> <Statement Code> <Presentation Code> <Close Connection Code> </td> </tr></table></body></html> 37 12

13 3 rd Attempt Presentation Code <table> <tr> <th>id</th> <th>pid</th> <th>first Name</th> <th>middle Name</th> <th>last Name</th> </tr> <Insert Form Code> <%-- Iterate over the ResultSet --%> <% while ( rs.next() ) { %> <Iteration Code> <% %> </table> 38 3 rd Attempt Iteration Code <tr> <form action="students.jsp" method= POST"> <input type="hidden" name="action" value="update"/> <input type="hidden" name="id" value="<%=rs.getint( id")%>"/> <%-- Get the pid --%> <td><input value="<%=rs.getint( pid)%>" name= pid /></td> <td><input type="submit" value="update"></td> </form> <form action="students.jsp" method= POST"> <input type="hidden" name="action" value="delete"/> <input type="hidden" value="<%=rs.getint( id")%>" name="id"/> <td><input type="submit" value="delete"/></td> </form> </tr> 39 3 rd Attempt Delete Code // Check if a delete is requested if (action!= null && action.equals("delete")) { // Create the prepared statement to DELETE students pstmt = conn.preparestatement( "DELETE FROM Students WHERE id =?"); pstmt.setint(1, Integer.parseInt(request.getParameter("id"))); int rowcount = 40 13

14 3 rd Attempt Update Code // Check if an update is requested if (action!= null && action.equals("update")) { // Create the prepared statement to UPDATE student values pstmt = conn.preparestatement( "UPDATE students SET pid =?, first_name =? middle_name =?, last_name =? WHERE ID =?"); pstmt.setint(1, Integer.parseInt(request.getParameter("pid"))); int rowcount = 41 14