PreparedStatement Change

[vijay umar]

I am trying to convert this dyanamic query into a preparedStatement to fetch data from a table in an efficent way.The query has 4 attributes which are required to be displayed according to the user input and even if the user enters only one input it should return all the other attributes.

query = "SELECT PC.PROD_CAT_ID,PC.HERITAGE_CD,PC.PROD_SHRT_DESC,PC.PROD_LONG_DESC,SOR.MNEMONIC,SOR.LOCATION_CD,"
					+ "PC.PROD_DSPLY_DESC,PC.AFF_ELIGIBLE,PC.INTEREST_BEARING FROM "
					+ dBSchema
					+ "."
					+ "PRODUCT_CATALOG PC,"
					+ dBSchema
					+ "."
					+ "SYSTEM_OF_RECORD SOR " + "WHERE PC.SOR_ID = SOR.SOR_ID ";
	/*
			if (selectedLocation != null
					&& !selectedLocation.equalsIgnoreCase("Default"))
				query = query + "AND UPPER(SOR.LOCATION_CD) = '"
						+ selectedLocation.trim().toUpperCase() + "'";
			if (selectedProduct != null
					&& !selectedProduct.equalsIgnoreCase("Default"))
				query = query + " AND PC.PROD_CAT_ID = " + selectedProduct;
			if (prodLongDescr != null && !prodLongDescr.equalsIgnoreCase(""))
				query = query + " AND UPPER(PC.PROD_LONG_DESC) LIKE '%"
						+ prodLongDescr.trim().toUpperCase() + "%' ";
			if (productType != null && !productType.equalsIgnoreCase("All"))
				query = query + " AND PC.INTEREST_BEARING = '" + productType
						+ "'";
						query = query + " ORDER BY PC.PROD_CAT_ID,PC.HERITAGE_CD";
			stmt = con.createStatement();
			rs = stmt.executeQuery(query);

Some one please help me with this,I am not able to make the query in the if statement as prepared statement.

[Darryl Burke]

vijay, please CarefullyChooseOneForum. I've removed the identical threads you started in Java in General and Performance.

[rav pad]

Vijay,

You mean to say con.prepareStatement(YOUR QUERY) doesnt work?

[vijay umar]

I am sorry for multiple post Darryl.

Hello Rav,the first query using select is appended at every if condition used,So i just need to make those query=query+..... statements as prepared statements.

[vijay umar]

People,do you need more clarity on this?

[rav pad]

Vijay,
I understood your requirement. This is query is used for a search page where the results are displayed based on the conditions selected.
1) Do you want to pass on the paramters to the statement during run time like we do for prepared statements?
2) If yes for above question then how do you intend to construct the query?
3) Why do you want to use preparedstatements?

[Ashwin Sridhar]

Vijay,

I don't understand. What your problem with this. from your code, i find that, you are not binding the values to the query, you append it to query. Then you can simply use Statement instead of prepared statement