Skip to content

Commit 46e0d20

Browse files
matthewhillierReidWeb
matthewhillier
authored and
ReidWeb
committed
Reworked the PlayerBeanDAO so that it uses PreparedStatements instead of Statements, and passes values as objects for the driver to ensure they're safe and properly escaped.
1 parent 1d9c074 commit 46e0d20

1 file changed

Lines changed: 94 additions & 67 deletions

File tree

‎src/main/java/com/ffxivcensus/gatherer/player/PlayerBeanDAO.java‎

Lines changed: 94 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.ffxivcensus.gatherer.player;
22

33
import java.util.ArrayList;
4+
import java.util.Arrays;
45
import java.util.List;
56

67
import org.apache.commons.lang.BooleanUtils;
@@ -34,9 +35,9 @@ public PlayerBeanDAO(@Autowired final ApplicationConfig appConfig, @Autowired fi
3435
*/
3536
public List<Integer> getAdded(final int startId, final int endId) {
3637
List<Integer> addedIDs = new ArrayList<>();
37-
String sql = "SELECT * FROM tblplayers WHERE `id`>=" + startId + " AND `id`<=" + endId + ";";
38+
String sql = "SELECT * FROM tblplayers WHERE `id`>= ? AND `id`<= ?;";
3839

39-
jdbcTemplate.query(sql, (rs, rowNum) -> addedIDs.add(rs.getInt("id")));
40+
jdbcTemplate.query(sql, new Object[] {startId, endId}, (rs, rowNum) -> addedIDs.add(rs.getInt("id")));
4041

4142
return addedIDs;
4243
}
@@ -49,110 +50,136 @@ public String saveRecord(final PlayerBean player) {
4950

5051
// Declare string builders to build up components of statement
5152
StringBuilder sbFields = new StringBuilder();
52-
StringBuilder sbValues = new StringBuilder();
5353

54-
// Set default table name
55-
String tableName = "tblplayers";
54+
List<Object> values = new ArrayList<>();
5655

57-
sbFields.append("INSERT IGNORE INTO ").append(tableName).append(" (");
58-
sbValues.append(" VALUES (");
56+
sbFields.append("INSERT IGNORE INTO tblplayers (");
5957

6058
sbFields.append("id, name, realm, race, gender, grand_company,free_company,");
61-
sbValues.append(player.getId() + ",\"" + player.getPlayerName() + "\",\"" + player.getRealm() + "\",\"" + player.getRace()
62-
+ "\",'" + player.getGender() + "','" + player.getGrandCompany() + "',\"" + player.getFreeCompany() + "\",");
59+
values.add(player.getId());
60+
values.add(player.getPlayerName());
61+
values.add(player.getRealm());
62+
values.add(player.getRace());
63+
values.add(player.getGender());
64+
values.add(player.getGrandCompany());
65+
values.add(player.getFreeCompany());
6366

6467
sbFields.append("level_gladiator, level_pugilist, level_marauder,level_lancer, level_archer, level_rogue,");
65-
sbValues.append(player.getLvlGladiator() + "," + player.getLvlPugilist() + "," + player.getLvlMarauder() + ","
66-
+ player.getLvlLancer() + "," + player.getLvlArcher() + "," + player.getLvlRogue() + ",");
68+
values.add(player.getLvlGladiator());
69+
values.add(player.getLvlPugilist());
70+
values.add(player.getLvlMarauder());
71+
values.add(player.getLvlLancer());
72+
values.add(player.getLvlArcher());
73+
values.add(player.getLvlRogue());
6774

6875
sbFields.append("level_conjurer, level_thaumaturge, level_arcanist, level_astrologian, level_darkknight,"
6976
+ " level_machinist,");
70-
sbValues.append(player.getLvlConjurer() + "," + player.getLvlThaumaturge() + "," + player.getLvlArcanist() + ","
71-
+ player.getLvlAstrologian() + "," + player.getLvlDarkKnight() + "," + player.getLvlMachinist() + ",");
77+
values.add(player.getLvlConjurer());
78+
values.add(player.getLvlThaumaturge());
79+
values.add(player.getLvlArcanist());
80+
values.add(player.getLvlAstrologian());
81+
values.add(player.getLvlDarkKnight());
82+
values.add(player.getLvlMachinist());
7283

7384
sbFields.append("level_scholar, level_redmage, level_samurai,");
74-
sbValues.append(player.getLvlScholar() + "," + player.getLvlRedMage() + "," + player.getLvlSamurai() + ",");
85+
values.add(player.getLvlScholar());
86+
values.add(player.getLvlRedMage());
87+
values.add(player.getLvlSamurai());
7588

7689
sbFields.append("level_carpenter, level_blacksmith, level_armorer, level_goldsmith, level_leatherworker, level_weaver, level_alchemist,");
77-
sbValues.append(player.getLvlCarpenter() + "," + player.getLvlBlacksmith() + "," + player.getLvlArmorer() + ","
78-
+ player.getLvlGoldsmith() + "," + player.getLvlLeatherworker() + "," + player.getLvlWeaver() + ","
79-
+ player.getLvlAlchemist() + ",");
90+
values.add(player.getLvlCarpenter());
91+
values.add(player.getLvlBlacksmith());
92+
values.add(player.getLvlArmorer());
93+
values.add(player.getLvlGoldsmith());
94+
values.add(player.getLvlLeatherworker());
95+
values.add(player.getLvlWeaver());
96+
values.add(player.getLvlAlchemist());
8097

8198
sbFields.append("level_culinarian, level_miner, level_botanist, level_fisher");
82-
sbValues.append(player.getLvlCulinarian() + "," + player.getLvlMiner() + "," + player.getLvlBotanist() + ","
83-
+ player.getLvlFisher());
99+
values.add(player.getLvlCulinarian());
100+
values.add(player.getLvlMiner());
101+
values.add(player.getLvlBotanist());
102+
values.add(player.getLvlFisher());
84103

85104
if(appConfig.isStoreProgression()) {
86-
sbFields.append(",");
87-
sbValues.append(",");
88-
89-
sbFields.append("p30days, p60days, p90days, p180days, p270days, p360days, p450days, p630days, p960days,");
90-
sbValues.append(booleanToInt(player.isHas30DaysSub()) + "," + booleanToInt(player.isHas60DaysSub()) + ","
91-
+ booleanToInt(player.isHas90DaysSub()) + "," + booleanToInt(player.isHas180DaysSub()) + ","
92-
+ booleanToInt(player.isHas270DaysSub()) + "," + booleanToInt(player.isHas360DaysSub()) + ","
93-
+ booleanToInt(player.isHas450DaysSub()) + "," + booleanToInt(player.isHas630DaysSub()) + ","
94-
+ booleanToInt(player.isHas960DaysSub()) + ",");
105+
sbFields.append(", p30days, p60days, p90days, p180days, p270days, p360days, p450days, p630days, p960days,");
106+
values.add(booleanToInt(player.isHas30DaysSub()));
107+
values.add(booleanToInt(player.isHas60DaysSub()));
108+
values.add(booleanToInt(player.isHas90DaysSub()));
109+
values.add(booleanToInt(player.isHas180DaysSub()));
110+
values.add(booleanToInt(player.isHas270DaysSub()));
111+
values.add(booleanToInt(player.isHas360DaysSub()));
112+
values.add(booleanToInt(player.isHas450DaysSub()));
113+
values.add(booleanToInt(player.isHas630DaysSub()));
114+
values.add(booleanToInt(player.isHas960DaysSub()));
95115

96116
sbFields.append("prearr, prehw, presb, arrartbook, hwartbookone, hwartbooktwo, hasencyclopedia, beforemeteor, beforethefall, soundtrack, saweternalbond, "
97117
+ "sightseeing, arr_25_complete, comm50, moogleplush, topazcarubuncleplush, emeraldcarbuncleplush,");
98-
sbValues.append(booleanToInt(player.isHasPreOrderArr()) + "," + booleanToInt(player.isHasPreOrderHW()) + ","
99-
+ booleanToInt(player.isHasPreOrderSB()) + "," + booleanToInt(player.isHasARRArtbook()) + ","
100-
+ booleanToInt(player.isHasHWArtbookOne()) + "," + booleanToInt(player.isHasHWArtbookTwo()) + ","
101-
+ booleanToInt(player.isHasEncyclopediaEorzea()) + "," + booleanToInt(player.isHasBeforeMeteor()) + ","
102-
+ booleanToInt(player.isHasBeforeTheFall()) + "," + booleanToInt(player.isHasSoundtrack()) + ","
103-
+ booleanToInt(player.isHasAttendedEternalBond()) + "," + booleanToInt(player.isHasCompletedHWSightseeing())
104-
+ "," + booleanToInt(player.isHasCompleted2pt5()) + "," + booleanToInt(player.isHasFiftyComms()) + ","
105-
+ booleanToInt(player.isHasMooglePlush()) + "," + booleanToInt(player.isHasTopazCarbunclePlush()) + ","
106-
+ booleanToInt(player.isHasEmeraldCarbunclePlush()) + ",");
118+
values.add(booleanToInt(player.isHasPreOrderArr()));
119+
values.add(booleanToInt(player.isHasPreOrderHW()));
120+
values.add(booleanToInt(player.isHasPreOrderSB()));
121+
values.add(booleanToInt(player.isHasARRArtbook()));
122+
values.add(booleanToInt(player.isHasHWArtbookOne()));
123+
values.add(booleanToInt(player.isHasHWArtbookTwo()));
124+
values.add(booleanToInt(player.isHasEncyclopediaEorzea()));
125+
values.add(booleanToInt(player.isHasBeforeMeteor()));
126+
values.add(booleanToInt(player.isHasBeforeTheFall()));
127+
values.add(booleanToInt(player.isHasSoundtrack()));
128+
values.add(booleanToInt(player.isHasAttendedEternalBond()));
129+
values.add(booleanToInt(player.isHasCompletedHWSightseeing()));
130+
values.add(booleanToInt(player.isHasCompleted2pt5()));
131+
values.add(booleanToInt(player.isHasFiftyComms()));
132+
values.add(booleanToInt(player.isHasMooglePlush()));
133+
values.add(booleanToInt(player.isHasTopazCarbunclePlush()));
134+
values.add(booleanToInt(player.isHasEmeraldCarbunclePlush()));
107135

108136
sbFields.append("hildibrand, ps4collectors, dideternalbond, arrcollector, kobold, sahagin, amaljaa, "
109137
+ "sylph, moogle, vanuvanu, vath, hw_complete, hw_31_complete, hw_33_complete, sb_complete, legacy_player");
110-
sbValues.append(booleanToInt(player.isHasCompletedHildibrand()) + "," + booleanToInt(player.isHasPS4Collectors()) + ","
111-
+ booleanToInt(player.isHasEternalBond()) + "," + booleanToInt(player.isHasARRCollectors()) + ","
112-
+ booleanToInt(player.isHasKobold()) + "," + booleanToInt(player.isHasSahagin()) + ","
113-
+ booleanToInt(player.isHasAmaljaa()) + "," + booleanToInt(player.isHasSylph()) + ","
114-
+ booleanToInt(player.isHasMoogle()) + "," + booleanToInt(player.isHasVanuVanu()) + ","
115-
+ booleanToInt(player.isHasVath()) + "," + booleanToInt(player.isHasCompletedHW()) + ","
116-
+ booleanToInt(player.isHasCompleted3pt1()) + "," + booleanToInt(player.isHasCompleted3pt3()) + ","
117-
+ booleanToInt(player.isHasCompletedSB()) + "," + booleanToInt(player.isLegacyPlayer()));
138+
values.add(booleanToInt(player.isHasCompletedHildibrand()));
139+
values.add(booleanToInt(player.isHasPS4Collectors()));
140+
values.add(booleanToInt(player.isHasEternalBond()));
141+
values.add(booleanToInt(player.isHasARRCollectors()));
142+
values.add(booleanToInt(player.isHasKobold()));
143+
values.add(booleanToInt(player.isHasSahagin()));
144+
values.add(booleanToInt(player.isHasAmaljaa()));
145+
values.add(booleanToInt(player.isHasSylph()));
146+
values.add(booleanToInt(player.isHasMoogle()));
147+
values.add(booleanToInt(player.isHasVanuVanu()));
148+
values.add(booleanToInt(player.isHasVath()));
149+
values.add(booleanToInt(player.isHasCompletedHW()));
150+
values.add(booleanToInt(player.isHasCompleted3pt1()));
151+
values.add(booleanToInt(player.isHasCompleted3pt3()));
152+
values.add(booleanToInt(player.isHasCompletedSB()));
153+
values.add(booleanToInt(player.isLegacyPlayer()));
118154

119155
}
120156

121157
if(appConfig.isStoreMinions()) {
122-
sbFields.append(",");
123-
sbValues.append(",");
124-
sbFields.append("minions");
125-
sbValues.append("\"" + StringUtils.join(player.getMinions(), ",") + "\"");
158+
sbFields.append(", minions");
159+
values.add(StringUtils.join(player.getMinions(), ","));
126160
}
127161
if(appConfig.isStoreMounts()) {
128-
sbFields.append(",");
129-
sbValues.append(",");
130-
sbFields.append("mounts");
131-
sbValues.append("\"" + StringUtils.join(player.getMounts(), ",") + "\"");
162+
sbFields.append(", mounts");
163+
values.add(StringUtils.join(player.getMounts(), ","));
132164
}
133165

134166
if(appConfig.isStoreActiveDate()) {
135-
sbFields.append(",");
136-
sbValues.append(",");
137-
sbFields.append("date_active");
138-
java.text.SimpleDateFormat sdf = new java.text.SimpleDateFormat("yyyy-MM-dd");
139-
140-
String sqlDate = sdf.format(player.getDateImgLastModified());
141-
sbValues.append("\"" + sqlDate + "\"");
167+
sbFields.append(", date_active");
168+
values.add(player.getDateImgLastModified());
142169
}
143170
if(appConfig.isStorePlayerActive()) {
144-
sbFields.append(",");
145-
sbValues.append(",");
146-
sbFields.append("is_active");
147-
sbValues.append(booleanToInt(player.isActive()));
171+
sbFields.append(", is_active");
172+
values.add(booleanToInt(player.isActive()));
148173
}
149174

150175
sbFields.append(")");
151-
sbValues.append(");");
152176

153-
String strSQL = sbFields.toString() + sbValues.toString();
177+
String[] params = new String[values.size()];
178+
Arrays.fill(params, "?");
179+
180+
String strSQL = sbFields.toString() + " VALUES(" + String.join(",", params) + ");";
154181

155-
jdbcTemplate.update(strSQL);
182+
jdbcTemplate.update(strSQL, values.toArray());
156183

157184
strOut = "Character " + player.getId() + " written to database successfully.";
158185
return strOut;

0 commit comments

Comments
 (0)