File APIs for Java Developers
Manipulate DOC, XLS, PPT, PDF and many others from your application.
The moose likes Servlets and the fly likes How good is to form a Query on the client Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Servlets
Bookmark "How good is to form a Query on the client " Watch "How good is to form a Query on the client " New topic

How good is to form a Query on the client

laxmikant shimpi

Joined: Sep 18, 2001
Posts: 21
I have a Question that
I am using JSP-Servlet-RequestProcessor-Bean-DAO (Data Access Object) - dB architecture.
We are building an Enterprise Application to be accessed by the users of an Intranet site.
We are bulding all the queries in side the JSP itself resulting the security threat to our application (as I feel it is)
What are the various ways to send the data to the Servlet to that servlet can use the information and constrcut the Queries ?
Is it good to design JSPs for building the SQL Queries (Insert, Update, Delete) ?
I would appreciate the response.

Sun Certified Java Programmer
chanoch wiggers
Ranch Hand

Joined: May 24, 2001
Posts: 245
isnt it the responsibility of the DAO objects to form the queries? If you have DAO objects that are not responsible for constructing the queries then you have a problem...
btw, I think it is safer to create prepared statements and then add the query details after wards if you want to protect against SQL injection.

chanoch<p><a href="" target="_blank" rel="nofollow">Author of Professional Apache Tomcat</a></p>
I agree. Here's the link:
subject: How good is to form a Query on the client
It's not a secret anymore!