replace the use of StringUtil.quote(String) with StringUtil.JDBCescapeStringLiteral...
[mir.git] / source / mir / storage / Database.java
index 79ac9ac..081a002 100755 (executable)
@@ -1,6 +1,34 @@
 /*
- * put your module comment here
+ * Copyright (C) 2001, 2002  The Mir-coders group
+ *
+ * This file is part of Mir.
+ *
+ * Mir is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * Mir is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Mir; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * In addition, as a special exception, The Mir-coders gives permission to link
+ * the code of this program with the com.oreilly.servlet library, any library
+ * licensed under the Apache Software License, The Sun (tm) Java Advanced
+ * Imaging library (JAI), The Sun JIMI library (or with modified versions of
+ * the above that use the same license as the above), and distribute linked
+ * combinations including the two.  You must obey the GNU General Public
+ * License in all respects for all of the code used other than the above
+ * mentioned libraries.  If you modify this file, you may extend this exception
+ * to your version of the file, but you are not obligated to do so.  If you do
+ * not wish to do so, delete this exception statement from your version.
  */
+
 package mir.storage;
 
 import  java.sql.*;
@@ -27,17 +55,9 @@ import  mir.misc.*;
  * Treiber, Host, User und Passwort, ueber den der Zugriff auf die
  * Datenbank erfolgt.
  *
- * @version $Revision: 1.19 $ $Date: 2002/06/29 15:44:46 $
+ * @version $Revision: 1.21.2.4 $ $Date: 2002/12/20 03:01:01 $
  * @author $Author: mh $
  *
- * $Log: Database.java,v $
- * Revision 1.19  2002/06/29 15:44:46  mh
- * make the webdb_create update be called webdb_create_update. it breaks things otherwise. a fixme case I know..
- *
- * Revision 1.18  2002/06/28 20:42:13  mh
- * added necessary bits in templates and Database.java to make webdb_create modifiable. make the conversion from sql/Timestamp to String more robust
- *
- *
  */
 public class Database implements StorageObject {
 
@@ -66,7 +86,7 @@ public class Database implements StorageObject {
   private SimpleDateFormat _dateFormatterOut = 
                                     new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
   private SimpleDateFormat _dateFormatterIn = 
-                                    new SimpleDateFormat("yyyy-MM-dd");
+                                    new SimpleDateFormat("yyyy-MM-dd HH:mm");
   private Calendar _cal = new GregorianCalendar();
 
   private static final int _millisPerHour = 60 * 60 * 1000;
@@ -262,13 +282,9 @@ public class Database implements StorageObject {
                                                break;
                                        case java.sql.Types.CHAR:case java.sql.Types.VARCHAR:case java.sql.Types.LONGVARCHAR:
                                                outValue = rs.getString(valueIndex);
-                                               //if (outValue != null)
-                                                       //outValue = StringUtil.encodeHtml(StringUtil.unquote(outValue));
                                                break;
                                        case java.sql.Types.LONGVARBINARY:
                                                outValue = rs.getString(valueIndex);
-                                               //if (outValue != null)
-                                               //outValue = StringUtil.encodeHtml(StringUtil.unquote(outValue));
                                                break;
                                        case java.sql.Types.TIMESTAMP:
             // it's important to use Timestamp here as getting it
@@ -668,7 +684,8 @@ public class Database implements StorageObject {
                                if (!aField.equals(thePKeyName)) {
                                        aValue = null;
                                        // sonderfaelle
-                                       if (aField.equals("webdb_create")) {
+                                       if (aField.equals("webdb_create") ||
+              aField.equals("webdb_lastchange")) {
                                                aValue = "NOW()";
                                        }
                                        else {
@@ -677,7 +694,7 @@ public class Database implements StorageObject {
                                                }
                                                else {
                                                        if (theEntity.hasValueForField(aField)) {
-                                                               aValue = "'" + StringUtil.quote((String)theEntity.getValue(aField))
+                                                               aValue = "'" + StringUtil.JDBCescapeStringLiteral((String)theEntity.getValue(aField))
                                                                                + "'";
                                                        }
                                                }
@@ -699,7 +716,7 @@ public class Database implements StorageObject {
                        // insert into db
                        StringBuffer sqlBuf = new StringBuffer("insert into ").append(theTable).append("(").append(f).append(") values (").append(v).append(")");
                        String sql = sqlBuf.toString();
-                       theLog.printInfo("INSERT: " + sql);
+                       //theLog.printInfo("INSERT: " + sql);
                        con = getPooledCon();
                        con.setAutoCommit(false);
                        pstmt = con.prepareStatement(sql);
@@ -780,7 +797,7 @@ public class Database implements StorageObject {
                                        else {
                                                firstField = false;
                                        }
-                                       fv.append(aField).append("='").append(StringUtil.quote((String)theEntity.getValue(aField))).append("'");
+                                       fv.append(aField).append("='").append(StringUtil.JDBCescapeStringLiteral((String)theEntity.getValue(aField))).append("'");
                                }
                        }
                }
@@ -789,22 +806,25 @@ public class Database implements StorageObject {
                if (metadataFields.contains("webdb_lastchange")) {
                        sql.append(",webdb_lastchange=NOW()");
                }
-    // special case: the webdb_create requires the field in yyyy-mm-dd format
-    // so anything extra will be ignored. which breaks actual updating when a 
-    // a change in date is not desired but the values hash has the correct and
-    // full "webdb_create" field and value in it. solution make it so the update
-    // must be called webdb_create_update. a hack I know.. hopefully
-    // we can replace this whole layer soon. -mh
+    // special case: the webdb_create requires the field in yyyy-mm-dd HH:mm
+    // format so anything extra will be ignored. -mh
                if (metadataFields.contains("webdb_create") &&
-        theEntity.hasValueForField("webdb_create_update")) {
-      // TimeStamp stuff
-      try {
-        java.util.Date d = _dateFormatterIn.parse(
-                                            theEntity.getValue("webdb_create"));
-        Timestamp tStamp = new Timestamp(d.getTime());
-        sql.append(",webdb_create='"+tStamp.toString()+"'");
-      } catch (ParseException e) {
-        throw new StorageObjectException(e.toString());
+        theEntity.hasValueForField("webdb_create")) {
+      // minimum of 10 (yyyy-mm-dd)...
+      if (theEntity.getValue("webdb_create").length() >= 10) {
+        String dateString = theEntity.getValue("webdb_create");
+        // if only 10, then add 00:00 so it doesn't throw a ParseException
+        if (dateString.length() == 10)
+          dateString=dateString+" 00:00";
+
+        // TimeStamp stuff
+        try {
+          java.util.Date d = _dateFormatterIn.parse(dateString);
+          Timestamp tStamp = new Timestamp(d.getTime());
+          sql.append(",webdb_create='"+tStamp.toString()+"'");
+        } catch (ParseException e) {
+          throw new StorageObjectException(e.toString());
+        }
       }
                }
                if (streamedInput != null) {
@@ -813,7 +833,7 @@ public class Database implements StorageObject {
                        }
                }
                sql.append(" where id=").append(id);
-               theLog.printInfo("UPDATE: " + sql);
+               //theLog.printInfo("UPDATE: " + sql);
                // execute sql
                try {
                        con = getPooledCon();
@@ -861,7 +881,7 @@ public class Database implements StorageObject {
                Statement stmt = null; Connection con = null;
                int res = 0;
                String sql="delete from "+theTable+" where "+thePKeyName+"='"+id+"'";
-               theLog.printInfo("DELETE " + sql);
+               //theLog.printInfo("DELETE " + sql);
                try {
                        con = getPooledCon(); stmt = con.createStatement();
                        res = stmt.executeUpdate(sql);
@@ -1069,8 +1089,7 @@ public class Database implements StorageObject {
                        freeConnection(con,stmt);
                }
                //theLog.printInfo(theTable + " has "+ result +" rows where " + where);
-               theLog.printInfo((System.currentTimeMillis() - startTime) + "ms. for: "
-                                                                               + sql);
+               //theLog.printInfo((System.currentTimeMillis() - startTime) + "ms. for: " + sql);
                return result;
        }
 
@@ -1082,8 +1101,7 @@ public class Database implements StorageObject {
                try
                {
                        rs = stmt.executeUpdate(sql);
-                       theLog.printInfo((new java.util.Date().getTime() - startTime) + "ms. for: "
-                                                                                               + sql);
+                       //theLog.printInfo((new java.util.Date().getTime() - startTime) + "ms. for: " + sql);
                }
                catch (SQLException e)
                {
@@ -1106,12 +1124,11 @@ public class Database implements StorageObject {
                        result = pstmt.executeUpdate();
                }
                catch (Exception e) {
-                       theLog.printDebugInfo("settimage :: setImage gescheitert: "+e.toString());
+                       theLog.printDebugInfo("executeUpdate failed: "+e.toString());
                        throw new StorageObjectException("executeUpdate failed: "+e.toString());
                }
                finally { freeConnection(con,pstmt); }
-               theLog.printInfo((new java.util.Date().getTime() - startTime) + "ms. for: "
-                                                                               + sql);
+               //theLog.printInfo((new java.util.Date().getTime() - startTime) + "ms. for: " + sql);
                return result;
        }
 
@@ -1161,7 +1178,7 @@ public class Database implements StorageObject {
                try {
                        con = getPooledCon();
                        pstmt = con.prepareStatement(sql);
-                       theLog.printInfo("METADATA: " + sql);
+                       //theLog.printInfo("METADATA: " + sql);
                        ResultSet rs = pstmt.executeQuery();
                        evalMetaData(rs.getMetaData());
                        rs.close();