Skip to content

Use prepared statements for database operations #284

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BenCodez merged 8 commits into from
Aug 5, 2026
Merged

Use prepared statements for database operations #284

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0f5a047
Use bound values in SQLite user queries
BenCodez Aug 5, 2026
f468b48
Use bound values in user database queries
BenCodez Aug 5, 2026
3f23b1e
Use bound values in global data queries
BenCodez Aug 5, 2026
4d495ba
Test prepared SQLite user queries
BenCodez Aug 5, 2026
b15cb64
Bind global data values as text
BenCodez Aug 5, 2026
dcbb26e
Bind boolean user values as text
BenCodez Aug 5, 2026
05f7f99
Bind global integer values by column type
BenCodez Aug 5, 2026
2345d0b
Verify global column types before binding
BenCodez Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
232 changes: 122 additions & 110 deletions AdvancedCore/src/main/java/com/bencodez/advancedcore/api/user/userstorage/mysql/MySQL.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -395,24 +395,25 @@ public ArrayList<String> getNamesQuery() {
}

public String getUUID(String playerName) {
String query = "SELECT " + qi("uuid") + " FROM " + qi(tableName) + " WHERE " + qi("PlayerName") + "='"
+ playerName + "';";
String query = "SELECT " + qi("uuid") + " FROM " + qi(tableName) + " WHERE " + qi("PlayerName") + "=?;";
plugin.devDebug("DB QUERY: " + query);

try (Connection conn = mysql.getConnectionManager().getConnection();
PreparedStatement sql = conn.prepareStatement(query);
ResultSet rs = sql.executeQuery()) {

if (rs.next()) {
if (dbType == DbType.POSTGRESQL) {
Object obj = rs.getObject(1);
if (obj instanceof java.util.UUID) {
return ((java.util.UUID) obj).toString();
PreparedStatement sql = conn.prepareStatement(query)) {
sql.setString(1, playerName);
try (ResultSet rs = sql.executeQuery()) {

if (rs.next()) {
if (dbType == DbType.POSTGRESQL) {
Object obj = rs.getObject(1);
if (obj instanceof java.util.UUID) {
return ((java.util.UUID) obj).toString();
}
}
String uuid = rs.getString(1);
if (uuid != null && !uuid.isEmpty()) {
return uuid;
}
}
String uuid = rs.getString(1);
if (uuid != null && !uuid.isEmpty()) {
return uuid;
}
}
} catch (SQLException e) {
Expand Down Expand Up @@ -537,17 +538,14 @@ public ConcurrentHashMap<UUID, String> getRowsUUIDNameQuery() {
// -------------------------

public void deletePlayer(String uuid) {
String q;
if (dbType == DbType.POSTGRESQL) {
q = "DELETE FROM " + qi(tableName) + " WHERE " + qi("uuid") + "='" + uuid + "'::uuid;";
} else {
q = "DELETE FROM " + qi(tableName) + " WHERE " + qi("uuid") + "='" + uuid + "';";
}
String q = "DELETE FROM " + qi(tableName) + " WHERE " + qi("uuid") + "=?;";
plugin.devDebug("DB QUERY: " + q);

try {
new Query(mysql, q).executeUpdate();
} catch (SQLException e) {
try (Connection conn = mysql.getConnectionManager().getConnection();
PreparedStatement statement = conn.prepareStatement(q)) {
bindUuid(statement, 1, uuid);
statement.executeUpdate();
} catch (SQLException | IllegalArgumentException e) {
debug(e);
}

Expand Down Expand Up @@ -650,53 +648,52 @@ public ArrayList<Column> getExact(String uuid) {
public ArrayList<Column> getExactQuery(Column column) {
ArrayList<Column> result = new ArrayList<>();

String query;
if (dbType == DbType.POSTGRESQL && "uuid".equalsIgnoreCase(column.getName())) {
query = "SELECT * FROM " + qi(tableName) + " WHERE " + qi("uuid") + "='" + column.getValue().getString()
+ "'::uuid;";
} else {
query = "SELECT * FROM " + qi(tableName) + " WHERE " + qi(column.getName()) + "='"
+ column.getValue().getString() + "';";
}
String query = "SELECT * FROM " + qi(tableName) + " WHERE " + qi(column.getName()) + "=?;";

plugin.devDebug("DB QUERY: " + query);

try (Connection conn = mysql.getConnectionManager().getConnection();
PreparedStatement sql = conn.prepareStatement(query);
ResultSet rs = sql.executeQuery()) {

if (rs.next()) {
for (int i = 1; i <= rs.getMetaData().getColumnCount(); i++) {
String columnName = rs.getMetaData().getColumnLabel(i);
Column rCol;

if (plugin.getUserManager().getDataManager().isInt(columnName)) {
rCol = new Column(columnName, DataType.INTEGER);
try {
rCol.setValue(new DataValueInt(rs.getInt(i)));
} catch (Exception e) {
String data = rs.getString(i);
if (data != null) {
try {
rCol.setValue(new DataValueInt(Integer.parseInt(data)));
} catch (NumberFormatException ex) {
PreparedStatement sql = conn.prepareStatement(query)) {
if (dbType == DbType.POSTGRESQL && "uuid".equalsIgnoreCase(column.getName())) {
bindUuid(sql, 1, column.getValue().getString());
} else {
bindValue(sql, 1, column.getValue());
}
try (ResultSet rs = sql.executeQuery()) {

if (rs.next()) {
for (int i = 1; i <= rs.getMetaData().getColumnCount(); i++) {
String columnName = rs.getMetaData().getColumnLabel(i);
Column rCol;

if (plugin.getUserManager().getDataManager().isInt(columnName)) {
rCol = new Column(columnName, DataType.INTEGER);
try {
rCol.setValue(new DataValueInt(rs.getInt(i)));
} catch (Exception e) {
String data = rs.getString(i);
if (data != null) {
try {
rCol.setValue(new DataValueInt(Integer.parseInt(data)));
} catch (NumberFormatException ex) {
rCol.setValue(new DataValueInt(0));
}
} else {
rCol.setValue(new DataValueInt(0));
}
} else {
rCol.setValue(new DataValueInt(0));
}
} else if (plugin.getUserManager().getDataManager().isBoolean(columnName)) {
rCol = new Column(columnName, DataType.BOOLEAN);
rCol.setValue(new DataValueBoolean(Boolean.valueOf(rs.getString(i))));
} else {
rCol = new Column(columnName, DataType.STRING);
rCol.setValue(new DataValueString(rs.getString(i)));
}
} else if (plugin.getUserManager().getDataManager().isBoolean(columnName)) {
rCol = new Column(columnName, DataType.BOOLEAN);
rCol.setValue(new DataValueBoolean(Boolean.valueOf(rs.getString(i))));
} else {
rCol = new Column(columnName, DataType.STRING);
rCol.setValue(new DataValueString(rs.getString(i)));
result.add(rCol);
}
result.add(rCol);
}
return result;
}
return result;
} catch (SQLException | ArrayIndexOutOfBoundsException e) {
debug(e);
}
Expand Down Expand Up @@ -728,10 +725,10 @@ public void insertQuery(String index, List<Column> cols) {
sb.append(", ").append(qi(col.getName()));
}

sb.append(") VALUES ('").append(index).append("'::uuid");
sb.append(") VALUES (?");

for (Column col : cols) {
sb.append(", '").append(col.getValue().toString()).append("'");
sb.append(", ?");
}

sb.append(") ON CONFLICT (").append(qi("uuid")).append(") DO UPDATE SET ");
Expand All @@ -749,32 +746,37 @@ public void insertQuery(String index, List<Column> cols) {
plugin.devDebug("DB QUERY: " + query);

try {
new Query(mysql, query).executeUpdate();
Query prepared = new Query(mysql, query);
prepared.setParameter(1, UUID.fromString(index));
for (int i = 0; i < cols.size(); i++) {
prepared.setParameter(i + 2, toSqlValue(cols.get(i).getValue()));
}
prepared.executeUpdate();
} catch (Exception e) {
debug(e);
plugin.debug("Failed to insert/upsert player " + index);
}
} else {
// MySQL/MariaDB: keep original INSERT IGNORE ... SET ...
String query = "INSERT IGNORE " + qi(tableName) + " set " + qi("uuid") + "='" + index + "', ";

StringBuilder query = new StringBuilder("INSERT IGNORE INTO ").append(qi(tableName)).append(" (")
.append(qi("uuid"));
for (Column col : cols) {
query.append(", ").append(qi(col.getName()));
}
query.append(") VALUES (?");
for (int i = 0; i < cols.size(); i++) {
Column col = cols.get(i);
boolean last = (i == cols.size() - 1);

if (col.getValue().isString()) {
query += qi(col.getName()) + "='" + col.getValue().getString() + "'" + (last ? ";" : ", ");
} else if (col.getValue().isBoolean()) {
query += qi(col.getName()) + "='" + col.getValue().getBoolean() + "'" + (last ? ";" : ", ");
} else if (col.getValue().isInt()) {
query += qi(col.getName()) + "='" + col.getValue().getInt() + "'" + (last ? ";" : ", ");
}
query.append(", ?");
}
query.append(");");

plugin.devDebug("DB QUERY: " + query);
plugin.devDebug("DB QUERY: " + query.toString());

try {
new Query(mysql, query).executeUpdate();
Query prepared = new Query(mysql, query.toString());
prepared.setParameter(1, index);
for (int i = 0; i < cols.size(); i++) {
prepared.setParameter(i + 2, toSqlValue(cols.get(i).getValue()));
}
prepared.executeUpdate();
} catch (Exception e) {
debug(e);
plugin.debug("Failed to insert player " + index);
Expand Down Expand Up @@ -803,40 +805,33 @@ public void update(String index, List<Column> cols, boolean runAsync) {
for (Column col : cols) {
checkColumn(col.getName(), col.getDataType());
}
if (cols.isEmpty()) {
return;
}

synchronized (updateLock) {
if (getUuids().contains(index) || containsKeyQuery(index)) {
StringBuilder sb = new StringBuilder();
sb.append("UPDATE ").append(qi(tableName)).append(" SET ");

for (int i = 0; i < cols.size(); i++) {
Column col = cols.get(i);
boolean last = (i == cols.size() - 1);

if (col.getValue().isString()) {
sb.append(qi(col.getName())).append("='").append(col.getValue().getString()).append("'");
} else if (col.getValue().isBoolean()) {
sb.append(qi(col.getName())).append("='").append(col.getValue().getBoolean()).append("'");
} else if (col.getValue().isInt()) {
sb.append(qi(col.getName())).append("='").append(col.getValue().getInt()).append("'");
}

if (!last) {
sb.append(qi(cols.get(i).getName())).append("=?");
if (i != cols.size() - 1) {
sb.append(", ");
}
}

if (dbType == DbType.POSTGRESQL) {
sb.append(" WHERE ").append(qi("uuid")).append("='").append(index).append("'::uuid;");
} else {
sb.append(" WHERE ").append(qi("uuid")).append("='").append(index).append("';");
}
sb.append(" WHERE ").append(qi("uuid")).append("=?;");

String query = sb.toString();
plugin.devDebug("DB QUERY: " + query);

try {
Query q = new Query(mysql, query);
for (int i = 0; i < cols.size(); i++) {
q.setParameter(i + 1, toSqlValue(cols.get(i).getValue()));
}
q.setParameter(cols.size() + 1, toUuidValue(index));
if (runAsync) {
q.executeUpdateAsync();
} else {
Expand All @@ -861,26 +856,15 @@ public void update(String index, String column, DataValue value) {

synchronized (updateLock) {
if (getUuids().contains(index) || containsKeyQuery(index)) {
String query = "UPDATE " + qi(tableName) + " SET ";

if (value.isString()) {
query += qi(column) + "='" + value.getString() + "'";
} else if (value.isBoolean()) {
query += qi(column) + "='" + value.getBoolean() + "'";
} else if (value.isInt()) {
query += qi(column) + "='" + value.getInt() + "'";
}

if (dbType == DbType.POSTGRESQL) {
query += " WHERE " + qi("uuid") + "='" + index + "'::uuid;";
} else {
query += " WHERE " + qi("uuid") + "='" + index + "';";
}
String query = "UPDATE " + qi(tableName) + " SET " + qi(column) + "=? WHERE " + qi("uuid") + "=?;";

plugin.devDebug("DB QUERY: " + query);

try {
new Query(mysql, query).executeUpdate();
Query prepared = new Query(mysql, query);
prepared.setParameter(1, toSqlValue(value));
prepared.setParameter(2, toUuidValue(index));
prepared.executeUpdate();
} catch (SQLException e) {
debug(e);
}
Expand All @@ -890,6 +874,34 @@ public void update(String index, String column, DataValue value) {
}
}

private void bindUuid(PreparedStatement statement, int parameter, String uuid) throws SQLException {
statement.setObject(parameter, toUuidValue(uuid));
}

private void bindValue(PreparedStatement statement, int parameter, DataValue value) throws SQLException {
statement.setObject(parameter, toSqlValue(value));
}

private Object toUuidValue(String uuid) {
return dbType == DbType.POSTGRESQL ? UUID.fromString(uuid) : uuid;
}

private Object toSqlValue(DataValue value) {
if (value == null) {
return null;
}
if (value.isString()) {
return value.getString();
}
if (value.isBoolean()) {
return String.valueOf(value.getBoolean());
}
if (value.isInt()) {
return value.getInt();
}
return value.toString();
}

public void wipeColumnData(String columnName, DataType dataType) {
checkColumn(columnName, dataType);

Expand Down
Loading
Loading