SQL query to retrieve data according to train_number - mysql

Question

I want to retrieve all the trains with the given coach type that runs between the source and destination from the database in ascending order based on train number;
I am trying this query.This is a JDBC code to fetch the trains. I couldn't figure out what is wrong in this.
`import java.sql.*;
import java.util.*;
import java.io.*;
public class TrainManagementSystem {
public ArrayList <Train> viewTrain (String coachType, String source, String destination){
// Fill your code here
Connection myConn =null;
PreparedStatement myStmt = null;
ResultSet myRes = null;
ArrayList <Train> trainArr = new ArrayList<>();
try{
Properties props = new Properties();
FileInputStream in = new FileInputStream("database.properties");
props.load(in);
in.close();
String driver = props.getProperty("DB_DRIVER_CLASS");
if (driver != null) {
Class.forName(driver) ;
}
myConn = DriverManager.getConnection(
props.getProperty("DB_URL"),
props.getProperty("DB_USERNAME"),
props.getProperty("DB_PASSWORD"));
myStmt = myConn.prepareStatement("SELECT * from train WHERE source = ? AND destination = ? AND ? != 0 ORDER BY train_number");
myStmt.setString(1,source);
myStmt.setString(2,destination);
myStmt.setString(3,coachType);
myRes = myStmt.executeQuery();
while(myRes.next()){
trainArr.add(new Train(
myRes.getInt("train_number"),
myRes.getString("train_name"),
myRes.getString("source"),
myRes.getString("destination"),
myRes.getInt("ac1"),
myRes.getInt("ac2"),
myRes.getInt("ac3"),
myRes.getInt("sleeper"),
myRes.getInt("seater")));
}
return trainArr;
}catch(Exception exc){
exc.printStackTrace();
return null;
}
}
}
coachType=ac1,ac2,ac3,sleeper,seater;

Answer 1

In my opinion there are two approaches:
make a SELECT without the condition on the parametrized column (derived from coachType) and filter the results in your Java code. You'll get all the trains with the desired source and destination, ordered by train_number
myStmt = myConn.prepareStatement("SELECT * from train WHERE source = ? AND destination = ? ORDER BY train_number");
myStmt.setString(1,source);
myStmt.setString(2,destination);
myRes = myStmt.executeQuery();
and then, in your loop on the resultset,
while(myRes.next()) {
if (myRes.getInt(coachType) != 0) { // excludes records with column derived from coachType != 0
trainArr.add(new Train(
myRes.getInt("train_number"),
myRes.getString("train_name"),
myRes.getString("source"),
myRes.getString("destination"),
myRes.getInt("ac1"),
myRes.getInt("ac2"),
myRes.getInt("ac3"),
myRes.getInt("sleeper"),
myRes.getInt("seater")));
}
}
To avoid SQL Injection you can make an apparently useless query:
firstStmt = myConn.prepareStatement("SELECT column_name FROM information_schema.columns WHERE table_schema = ? AND table_name = ? AND column_name = ?");
firstStmt.setString(1, table_schema); // a variable with your schema name
firstStmt.setString(2, "train");
firstStmt.setString(3, coachType);
safeQueryRes = firstStmt.executeQuery();
safeCoachTypeColName = safeQueryRes.next().getString("column_name");
In this way you can use concatenation in your final query, avoiding SQL Injection, as if someone puts some hacking string in your coachType input variable, the first query will fail and nothing dangerous will happen. Otherwise, if the first query will be executed without a SQL Injection, you'll get the "real-and-SQL-Injection-safe" column name that you can use to create your final query with string concatenation:
myStmt = myConn.prepareStatement("SELECT * from train WHERE source = ? AND destination = ? AND " + safeCoachTypeColName + " != 0 ORDER BY train_number");
myStmt.setString(1,source);
myStmt.setString(2,destination);
myRes = myStmt.executeQuery();