diff --git a/entity/Comm_entity/conditionProcess.js b/entity/Comm_entity/conditionProcess.js index 56359a39d6f6d38933a3322f8a5b514bd1ca5e81..5bf7469f85c8e27b37bdb2eee25ad40cfca6a706 100644 --- a/entity/Comm_entity/conditionProcess.js +++ b/entity/Comm_entity/conditionProcess.js @@ -24,4 +24,4 @@ if (vars.exists("$param.MediumCategoriesFilter_param")){ } } -result.string(db.translateCondition([cond.toString("1 = 2"), cond.preparedValues])); \ No newline at end of file +result.string(db.translateCondition(cond.build("1 = 2"))); \ No newline at end of file diff --git a/others/guide/HowToSqlConditionLib.adoc b/others/guide/HowToSqlConditionLib.adoc new file mode 100644 index 0000000000000000000000000000000000000000..fb3916335850d78f07e686f9f9eb823112282870 --- /dev/null +++ b/others/guide/HowToSqlConditionLib.adoc @@ -0,0 +1,139 @@ +How to use the SqlCondition +=========================== +:toc2: left +:numbered: + +(This lib is work in progress and may change in the future.) + +== What is the SqlCondition == +It is a lib which helps to creating SQL statements and especially simplifies prepared Statements. + +== When should prepared statements be used == +If possible always. +Prepared statements improve the application security significantly. +See also AID068-DE - SQL Injections + +== basics == +* import the lib: +[source,javascript] +---- +import("Sql_lib"); +---- +* create an object (alias is optional) +[source,javascript] +---- +var myDescriptiveNameOfTheCondition = new SqlCondition(alias); +// or +var myDescriptiveNameOfTheCondition = SqlCondition.begin(alias); +---- +* use the object, add conditions +[source,javascript] +---- +myDescriptiveNameOfTheCondition.orPrepare("PERS.FIRSTNAME", "Bob") + .orPrepare("PERS.LASTNAME", "Meier"); +---- +* build sql +[source,javascript] +---- +var myPreparedSelect = myDescriptiveNameOfTheCondition.build("select PERSID from PERS"); +---- +* use the select +[source,javascript] +---- +var bobsId = db.cell(myPreparedSelect); +---- + +You can do everything in one command also: +[source,javascript] +---- +var bobsId = db.cell(SqlCondition.begin(alias) + .orPrepare("PERS.FIRSTNAME", "Bob") + .orPrepare("PERS.LASTNAME", "Meier"); + .build("select PERSID from PERS")); +---- + +== available methods == +This is only a simple overview. +for more information see the comments and documentation in the lib! + +=== and / or === +Adds a condition. Doesn't use prepared Statements!! +Please prefer the prepared version! + +[source,javascript] +---- +myDescriptiveNameOfTheCondition.or("FIRSTNAME = 'Bob'"); +---- + +=== andPrepared / orPrepared === +Same as and / or but uses prepared statements. +The field name needs to be given with +[TABLENAME].[COLUMNNAME] + +Or if you use only COLUMNNAME, you have to provide the fieldType. + +[source,javascript] +---- +myDescriptiveNameOfTheCondition.orPrepared("PERS.FIRSTNAME", 'Bob', "#<?"); +---- + +=== andPreparedVars / orPreparedVars === +Same as andPrepared / orPrepared but you can provide a jdito-variable instead of a value. +If this variable doesn't exist or is empty, no condition is added. + +[source,javascript] +---- +myDescriptiveNameOfTheCondition.andPrepareVars("COMM.RELATION_ID", "$param.RelId_param"); +---- + +=== andSqlCondition / orSqlCondition === +adds another SqlCondition object + +[source,javascript] +---- +myDescriptiveNameOfTheCondition.andSqlCondition(SqlCondition.begin() + .orPrepare("PRODUCTPRICE.VALID_TO", today, "# >= ?") + .or("PRODUCTPRICE.VALID_TO is null"), "1 = 2"); +---- + +=== toString === +Returns the condition as SQL string with ? for each prepared value. +You can provide a default condition if it is empty. + +[source,javascript] +---- +var myConditionSql = myDescriptiveNameOfTheCondition.toString("1=0"); +---- + +=== toWhereString === +same as toString, but appends a where in front of it + +[source,javascript] +---- +var myConditionSql = myDescriptiveNameOfTheCondition.toWhereString("1=0"); +---- + +=== preparedValues === +This is no method but a membervariable. +It contains the array with the prepared values. + +[source,javascript] +---- +var myValues = myDescriptiveNameOfTheCondition.preparedValues; +---- + +=== build === +Combines toString with the prepared values just like Adito needs it. + +[source,javascript] +---- +var myPreparedStatementArray = myDescriptiveNameOfTheCondition.build("1=0"); +---- + +=== buildSelect === +Same as build and adds a string before and after the condition. + +[source,javascript] +---- +var myPreparedStatementArray = myDescriptiveNameOfTheCondition.buildSelect("select * from PERS", "1=0", "order by FIRSTNAME"); +---- \ No newline at end of file