• Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

How good is to form a Query on the client

 
laxmikant shimpi
Greenhorn
Posts: 21
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I have a Question that
I am using JSP-Servlet-RequestProcessor-Bean-DAO (Data Access Object) - dB architecture.
We are building an Enterprise Application to be accessed by the users of an Intranet site.
We are bulding all the queries in side the JSP itself resulting the security threat to our application (as I feel it is)
What are the various ways to send the data to the Servlet to that servlet can use the information and constrcut the Queries ?
Is it good to design JSPs for building the SQL Queries (Insert, Update, Delete) ?
I would appreciate the response.
Laxmikant
SCJP
 
chanoch wiggers
Author
Ranch Hand
Posts: 245
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
isnt it the responsibility of the DAO objects to form the queries? If you have DAO objects that are not responsible for constructing the queries then you have a problem...
btw, I think it is safer to create prepared statements and then add the query details after wards if you want to protect against SQL injection.
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic