0

In insert query I use SEQUENCE, because of this I refused to use SimpleJdbcInsert....executeBatch(data);

String sql = "INSERT INTO "+ schema +"."+ tableName +" (id, " + fieldName1 + ", " + fieldName2 + ") VALUES (BUF_SEQ.nextval, ?, ?)";
List<Object[]> recordValues = new ArrayList<Object[]>();
//... add values of records to recordValues list

// run bash update for insert
jdbcTemplate.batchUpdate(sql, recordValues);

Maybe someone can suggest a better way use Springframework jdbc? To insert a large number of records. To test the field names in the SQL injection. ?

Sprinter
  • 717
  • 5
  • 11

1 Answers1

2

1) Instead of calling sequence in your insert query, create a trigger on id column of the table for insert. Take ref : How to create id with AUTO_INCREMENT on Oracle?
2) Now use Batch update of spring to do bulk insertion i.e. jdbcTemplate.batchUpdate
In your insert query now you no longer need to define id, every time you make insertion on the table, trigger will be fired and id will be incremented.
3) Use Prepared Statement for insert query in order to avoid sql injection.

Community
  • 1
  • 1
Amit Bhati
  • 5,569
  • 1
  • 24
  • 45
  • Prepared statements cannot protect you against SQL injection using object names (table and column names, etc). The only solid way is to either use a whitelist, or check against the `DatabaseMetaData`) – Mark Rotteveel Aug 07 '15 at 16:33