MAJ fill database sans sql injection
This commit is contained in:
NicolasFabregas
parent
0b833a3f64
commit
47c6215386
3 changed files with 180 additions and 234 deletions
|
|
@ -22,162 +22,7 @@ public class DataBase {
|
|||
}
|
||||
|
||||
|
||||
/**
|
||||
* La methode de remplissage de la base de donnees
|
||||
*/
|
||||
public void fillDataBase(){
|
||||
/*String sql="INSERT INTO 'myny.Test_Table'" +
|
||||
" ('annee_numero_de_tirage', "+
|
||||
" 'jour_de_tirage', "+
|
||||
" 'date_de_tirage',"+
|
||||
" 'date_de_forclusion',"+
|
||||
" 'boule_1' ,"+
|
||||
" 'boule_2' ,"+
|
||||
" 'boule_3' ,"+
|
||||
" 'boule_4' ,"+
|
||||
" 'boule_5' ,"+
|
||||
" 'numero_chance' ,"+
|
||||
" 'combinaison_gagnante_en_ordre_croissant' ,"+
|
||||
" 'nombre_de_gagnant_au_rang1' ,"+
|
||||
" 'rapport_du_rang1' ,"+
|
||||
" 'nombre_de_gagnant_au_rang2' ,"+
|
||||
" 'rapport_du_rang2' ,"+
|
||||
" 'nombre_de_gagnant_au_rang3' ,"+
|
||||
" 'rapport_du_rang3' ,"+
|
||||
" 'nombre_de_gagnant_au_rang4' ,"+
|
||||
" 'rapport_du_rang4' ,"+
|
||||
" 'nombre_de_gagnant_au_rang5' ,"+
|
||||
" 'rapport_du_rang5' ,"+
|
||||
" 'nombre_de_gagnant_au_rang6' ,"+
|
||||
" 'rapport_du_rang6' ,"+
|
||||
" 'numero_jokerplus' ,"+
|
||||
" 'devise' ) VALUES";*/
|
||||
String sql="INSERT INTO myny.Test_Table" +
|
||||
" (annee_numero_de_tirage, "+
|
||||
" jour_de_tirage, "+
|
||||
" date_de_tirage,"+
|
||||
" date_de_forclusion,"+
|
||||
" boule_1 ,"+
|
||||
" boule_2 ,"+
|
||||
" boule_3 ,"+
|
||||
" boule_4 ,"+
|
||||
" boule_5 ,"+
|
||||
" numero_chance ,"+
|
||||
" combinaison_gagnante_en_ordre_croissant ,"+
|
||||
" nombre_de_gagnant_au_rang1 ,"+
|
||||
" rapport_du_rang1 ,"+
|
||||
" nombre_de_gagnant_au_rang2 ,"+
|
||||
" rapport_du_rang2 ,"+
|
||||
" nombre_de_gagnant_au_rang3 ,"+
|
||||
" rapport_du_rang3 ,"+
|
||||
" nombre_de_gagnant_au_rang4 ,"+
|
||||
" rapport_du_rang4 ,"+
|
||||
" nombre_de_gagnant_au_rang5 ,"+
|
||||
" rapport_du_rang5 ,"+
|
||||
" nombre_de_gagnant_au_rang6 ,"+
|
||||
" rapport_du_rang6 ,"+
|
||||
" numero_jokerplus ,"+
|
||||
" devise ) VALUES \n";
|
||||
try {
|
||||
Scanner sc = new Scanner(new File(filePath));
|
||||
sc.useDelimiter(";|\\n"); //sets the delimiter pattern
|
||||
int i=0,j;
|
||||
long val;
|
||||
String line=sc.nextLine();
|
||||
line="";
|
||||
String date, jour, mois, an;
|
||||
while (sc.hasNext()){
|
||||
j=(i% NBCOL)+1;
|
||||
if(j==1) {
|
||||
line=line+'(';
|
||||
val=Long.parseLong(sc.next().replace(",","."));
|
||||
line=line+val;
|
||||
line=line+';';
|
||||
}
|
||||
if(j< NBCOL && j>1) {
|
||||
if (j==2 ||j==11){
|
||||
line=line+"\'"+sc.next().replace(",",".")+"\',";
|
||||
}
|
||||
else if (j==3 ||j==4){
|
||||
date=sc.next().replace(",",".");
|
||||
jour=date.substring(0,2);
|
||||
mois=date.substring(3,5);
|
||||
an=date.substring(6,10);
|
||||
line=line+"\'"+an+"-"+mois+"-"+jour+"\',";
|
||||
}
|
||||
else{
|
||||
line=line+sc.next().replace(",",".");
|
||||
line=line+';';
|
||||
}
|
||||
}
|
||||
if(j== NBCOL) {
|
||||
line=line+"\'"+sc.next().replace(",",".")+"\'";
|
||||
line=line+')';
|
||||
line=line.replaceAll("\\s","");
|
||||
line = line.replaceAll(";", ",");
|
||||
if(sc.hasNext()) {
|
||||
line = line+ ",";
|
||||
}
|
||||
else{
|
||||
line = line+ ";";
|
||||
}
|
||||
//System.out.println(line);
|
||||
sql=sql+line;
|
||||
line="";
|
||||
}
|
||||
i++;
|
||||
//System.out.println(sc.nextLine());
|
||||
//System.out.print(sc.next()); //find and returns the next complete token from this scanner
|
||||
}
|
||||
|
||||
System.out.println(sql);
|
||||
//System.out.println(sql);
|
||||
/*CSVReader reader = new CSVReader(new FileReader(filePath));
|
||||
String[] nextLine=reader.readNext();
|
||||
while ((nextLine = reader.readNext()) != null) {
|
||||
// nextLine[] is an array of values from the line
|
||||
for (int j = 0; j < nextLine.length - 1; j++) {
|
||||
if (j==0){
|
||||
sql=sql+"(";
|
||||
}
|
||||
sql=sql+nextLine[j];
|
||||
if (j==nextLine.length-1){
|
||||
sql=sql+"),";
|
||||
}
|
||||
else{
|
||||
sql=sql+",";
|
||||
}
|
||||
//System.out.println(nextLine[j]);
|
||||
}
|
||||
sql=sql+";";
|
||||
}
|
||||
System.out.println(sql);
|
||||
|
||||
conn = DriverManager.getConnection(url);
|
||||
if(conn!=null) {
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeQuery(sql);
|
||||
conn.commit();
|
||||
System.out.println("statement cree");
|
||||
}*/
|
||||
}
|
||||
catch (Exception e){
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
try {
|
||||
conn = this.getConnection();
|
||||
if(conn!=null) {
|
||||
Statement stmt = conn.createStatement();
|
||||
stmt.executeQuery(sql);
|
||||
conn.commit();
|
||||
//conn.close();
|
||||
System.out.println("statement cree");
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
System.out.println("oskour");
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* La methode dimport de donnees depuis la base de donnees
|
||||
|
|
@ -309,6 +154,133 @@ public class DataBase {
|
|||
}
|
||||
|
||||
|
||||
/**
|
||||
* La methode de remplissage de la base de donnees
|
||||
*/
|
||||
public void fillDataBase(){
|
||||
int i=0,j, nbValAj=0;
|
||||
long val;
|
||||
String line="";
|
||||
String date, jour, mois, an;
|
||||
long[][] mesL=new long[4000][NBCOL+1];
|
||||
String[][]mesS=new String[4000][NBCOL+1];
|
||||
Double[][]mesD=new Double[4000][NBCOL+1];
|
||||
String sql="INSERT INTO myny.Test_Table" +
|
||||
" (annee_numero_de_tirage, "+
|
||||
" jour_de_tirage, "+
|
||||
" date_de_tirage,"+
|
||||
" date_de_forclusion,"+
|
||||
" boule_1 ,"+
|
||||
" boule_2 ,"+
|
||||
" boule_3 ,"+
|
||||
" boule_4 ,"+
|
||||
" boule_5 ,"+
|
||||
" numero_chance ,"+
|
||||
" combinaison_gagnante_en_ordre_croissant ,"+
|
||||
" nombre_de_gagnant_au_rang1 ,"+
|
||||
" rapport_du_rang1 ,"+
|
||||
" nombre_de_gagnant_au_rang2 ,"+
|
||||
" rapport_du_rang2 ,"+
|
||||
" nombre_de_gagnant_au_rang3 ,"+
|
||||
" rapport_du_rang3 ,"+
|
||||
" nombre_de_gagnant_au_rang4 ,"+
|
||||
" rapport_du_rang4 ,"+
|
||||
" nombre_de_gagnant_au_rang5 ,"+
|
||||
" rapport_du_rang5 ,"+
|
||||
" nombre_de_gagnant_au_rang6 ,"+
|
||||
" rapport_du_rang6 ,"+
|
||||
" numero_jokerplus ,"+
|
||||
" devise ) VALUES \n";
|
||||
try {
|
||||
Scanner sc = new Scanner(new File(filePath));
|
||||
sc.useDelimiter(";|\\n"); //sets the delimiter pattern
|
||||
line=sc.nextLine();
|
||||
line="";
|
||||
while (sc.hasNext()){
|
||||
j=(i% NBCOL)+1;
|
||||
if(j==1) {
|
||||
line=line+"(?,";
|
||||
mesL[nbValAj][j]=Long.parseLong(sc.next());
|
||||
}
|
||||
if(j< NBCOL && j>1) {
|
||||
line = line + "?,";
|
||||
if (j==2 ||j==11){
|
||||
//line=line+"\'"+sc.next().replace(",",".")+"\',";
|
||||
mesS[nbValAj][j] = sc.next().replaceAll("\\s", "");
|
||||
|
||||
}
|
||||
else if (j==3 ||j==4){
|
||||
date=sc.next().replace(",",".");
|
||||
jour=date.substring(0,2);
|
||||
mois=date.substring(3,5);
|
||||
an=date.substring(6,10);
|
||||
mesS[nbValAj][j]=an+"-"+mois+"-"+jour;
|
||||
}
|
||||
else if (j >= 13 && j <= 23 && j % 2 == 1) {//pour les col 3 et 4, il s'agit d'une date, on va donc passer dela forme jj-mm-aaaa a la forme aaaa-mm-jj
|
||||
mesD[nbValAj][j] = Double.parseDouble(sc.next().replace(",", "."));
|
||||
|
||||
}
|
||||
else {//pour les autres col, on va simplement les remplir
|
||||
mesL[nbValAj][j] = Long.parseLong(sc.next().replaceAll("\\s", ""));
|
||||
}
|
||||
}
|
||||
if(j== NBCOL) {
|
||||
nbValAj++;
|
||||
line=line+"?)";
|
||||
mesS[nbValAj][j] = sc.next().replaceAll("\\s", "");
|
||||
if(sc.hasNext()) {
|
||||
line = line+ ",";
|
||||
}
|
||||
else{
|
||||
line = line+ ";";
|
||||
}
|
||||
//System.out.println(line);
|
||||
sql=sql+line;
|
||||
line="";
|
||||
}
|
||||
i++;
|
||||
}
|
||||
System.out.println(sql);
|
||||
}
|
||||
catch (Exception e){
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
if (nbValAj>0) {//si on a des modifications
|
||||
PreparedStatement ps = null;
|
||||
try {
|
||||
conn = this.getConnection();
|
||||
if (conn != null) {
|
||||
ps=conn.prepareStatement(sql);
|
||||
for(int a=0;a<nbValAj;a++){//pour chaque case de chaque ligne ajoutée, on va ajouter la valeur
|
||||
for(int b=1;b<=NBCOL;b++){//dans la declaration preparee, pour eviter les injections sql
|
||||
if((b>1&&b<5)||b==11||b==25){
|
||||
System.out.println("a: "+a+" et b: "+b);
|
||||
ps.setString((a)*25+b, mesS[a][b]);
|
||||
|
||||
}
|
||||
else if(b > 12 && b < 24 && b % 2 == 1){
|
||||
System.out.println("a: "+a+" et b: "+b);
|
||||
if (b == 13) {
|
||||
System.out.println(mesD[a][b]);
|
||||
}
|
||||
ps.setString((a)*25+b, mesD[a][b]+"");
|
||||
}
|
||||
else{
|
||||
System.out.println("a: "+a+" et b: "+b);
|
||||
ps.setString((a)*25+b, mesL[a][b]+"");
|
||||
}
|
||||
}
|
||||
}
|
||||
ps.executeQuery();//puis on execute la requete
|
||||
System.out.println("update validee");
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
System.out.println("oskour into update");
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* La methode de mise a jour de la base de donnees
|
||||
* @return sql String, contenant la requete SQL
|
||||
|
|
@ -434,12 +406,39 @@ public class DataBase {
|
|||
return sql;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* La methode de mise a jour de la base de donnees 2 qui evite les injections sql
|
||||
* @return sql String, contenant la requete SQL
|
||||
* @var mesL tableau dans lequel seront stockés tous les long
|
||||
* @var mesS tableau dans lequel seront stockés tous les String
|
||||
* @var mesD tableau dans lequel seront stockés tous les Double
|
||||
* @var sc Scanner, l objet qui servira a lire le fichier csv
|
||||
* @var line String, ligne contenant l'ajout a effectuer
|
||||
* @var i int, un compteur de valeurs lues,
|
||||
* @var j int, qui suit i%NBCOL
|
||||
* @var a int, un compteur de lignes modifiees
|
||||
* @var b int, un compteur de champs modifiees
|
||||
* @var nbValAj int qui augmente si on doit ajouter des lignes
|
||||
* @var date String, la valeur de la date lue
|
||||
* @var jour String, le jour lu
|
||||
* @var mois String, le mois lu
|
||||
* @var an String, l annee lue
|
||||
* @var anEntre long, valeur lue pour l annee et le numero de tirage. sert a definir si la valeur est a ajouter dans la table
|
||||
* @var ps PreparedStatement pour executer la requete sans injection sql
|
||||
* @var stmt Statement pour executer la requete de depart
|
||||
*/
|
||||
public String updateDataBasev2() throws FileNotFoundException {
|
||||
//Ligne maL=new Ligne();
|
||||
Statement stmt;
|
||||
long[][] mesL=new long[4000][NBCOL+1];
|
||||
String[][]mesS=new String[4000][NBCOL+1];
|
||||
Double[][]mesD=new Double[4000][NBCOL+1];
|
||||
Scanner sc;
|
||||
ResultSet rs;
|
||||
long anEntre;
|
||||
int i,j, nbValAj=0;
|
||||
String date, jour, mois, an;
|
||||
String line="";
|
||||
String sql="INSERT INTO myny.Test_Table" + //le debut de la requete, specifiant laction a effectuer, la table et la db
|
||||
" (annee_numero_de_tirage, "+
|
||||
" jour_de_tirage, "+
|
||||
|
|
@ -467,38 +466,29 @@ public class DataBase {
|
|||
" numero_jokerplus ,"+
|
||||
" devise ) VALUES \n";
|
||||
try {
|
||||
conn = this.getConnection(); //initialisation de la connexion
|
||||
if(conn!=null) { //si la co est bonne
|
||||
Scanner sc = new Scanner(new File(filePath)); //lire le fichier donne
|
||||
conn = this.getConnection(); //initialisation de la connexion
|
||||
if(conn!=null) { //si la co est bonne
|
||||
sc = new Scanner(new File(filePath)); //lire le fichier donne
|
||||
sc.useDelimiter(";|\\n"); //les delimiteurs seront ; et \n
|
||||
sc.nextLine(); //on ne conserve pas la premiere ligne, contenant les metadonnees
|
||||
long cpt=0;
|
||||
//Object[] champs;
|
||||
int i=0,j=0, nbValAj=0;
|
||||
String date, jour, mois, an;
|
||||
String line="";
|
||||
long anEntre=Long.parseLong(sc.next()); //lecture de l id en haut du tableau(donc le plus grand, cest ce qu on a constate en lisant le csv
|
||||
//System.out.println("numero en haut du fichier csv :"+anEntre);
|
||||
Statement stmt = conn.createStatement(); //recuperation du nb de lignes dans la table
|
||||
ResultSet rs = stmt.executeQuery("SELECT MAX(annee_numero_de_tirage) FROM myny.Test_Table;");
|
||||
anEntre=Long.parseLong(sc.next()); //lecture de l id en haut du tableau(donc le plus grand, cest ce qu on a constate en lisant le csv
|
||||
stmt = conn.createStatement(); //recuperation du nb de lignes dans la table
|
||||
rs = stmt.executeQuery("SELECT MAX(annee_numero_de_tirage) FROM myny.Test_Table;");
|
||||
rs.next();
|
||||
long maxvaldb=rs.getLong(1);
|
||||
//System.out.println("numero max de la db :"+rs.getLong(1));
|
||||
if (maxvaldb<0){
|
||||
maxvaldb=0;
|
||||
}
|
||||
/*comme les nombres de la premiere col sont decroissants, le nb le plus grand est lu en premier,
|
||||
on va donc lire les nombres jusqua arriver a la plus haute valeur entree dans la table. On ne
|
||||
pourrait probablement pas utiliser cette methode pour remplir la table en entier*/
|
||||
while(anEntre>maxvaldb) {
|
||||
while(anEntre>maxvaldb&&sc.hasNext()) {
|
||||
nbValAj++;//des quon rentre dans la boucle, on sait qu'on va devoir mettre a jour la table car cette valeur est>0
|
||||
for (i = 0; i < NBCOL; i++) {//on remplit la ligne en effectuant une lecture par col
|
||||
|
||||
j = (i % NBCOL) + 1;
|
||||
if (j == 1) {
|
||||
line = line + "(?,";//debut de la ligne a jouter
|
||||
mesL[nbValAj][j]=anEntre;
|
||||
//champs[cpt++]=anEntre;
|
||||
//line = line + anEntre;
|
||||
//line = line + ';';//on met un point virgule mais on le remplacera plus tard
|
||||
//sc.next();
|
||||
}
|
||||
if (j < NBCOL && j > 1) {//pour chaque colonne, on va faire en sorte de mettre le champ dans la onne mise en fore pour qu'il soit accepté par la db
|
||||
line = line + "?,";
|
||||
|
|
@ -531,53 +521,23 @@ public class DataBase {
|
|||
sql = sql + line + "\n";//on ajoute la ligne a la requete
|
||||
line = "";
|
||||
}
|
||||
|
||||
|
||||
/*if (j == 2 || j == 11) {
|
||||
line = line + "\'" + sc.next().replace(",", ".") + "\',";
|
||||
} else if (j == 3 || j == 4) {//pour les col 3 et 4, il s'agit d'une date, on va donc passer dela forme jj-mm-aaaa a la forme aaaa-mm-jj
|
||||
date = sc.next().replace(",", ".");
|
||||
jour = date.substring(0, 2);
|
||||
mois = date.substring(3, 5);
|
||||
an = date.substring(6, 10);
|
||||
line = line + "\'" + an + "-" + mois + "-" + jour + "\',";
|
||||
} else {//pour les autres col, on va simplement les remplir
|
||||
line = line + sc.next().replace(",", ".");
|
||||
line = line + ';';
|
||||
}
|
||||
}*/
|
||||
/*if (j == NBCOL) {//pour la derniere col
|
||||
line = line + "\'" + sc.next().replace(",", ".") + "\'";
|
||||
line = line + ')';//on la remplit
|
||||
line = line.replaceAll("\\s", "");//on remplace les caracteres qui nous derangent
|
||||
line = line.replaceAll(";", ",");
|
||||
anEntre = Long.parseLong(sc.next());//on lit le prochain id de l'entree
|
||||
if (anEntre > maxvaldb) {//on defini si on doit encore ajouter des lignes a la requete
|
||||
line = line + ",";
|
||||
} else {//ou si on doit cloturer la requete
|
||||
line = line + ";";
|
||||
}
|
||||
//System.out.println(line);
|
||||
sql = sql + line + "\n";//on ajoute la ligne a la requete
|
||||
line = "";
|
||||
}*/
|
||||
}
|
||||
}
|
||||
System.out.println(sql);
|
||||
if (nbValAj>0) {
|
||||
if (nbValAj>0) {//si on a des modifications
|
||||
PreparedStatement ps = null;
|
||||
try {
|
||||
conn = this.getConnection();
|
||||
if (conn != null) {
|
||||
ps=conn.prepareStatement(sql);
|
||||
for(int a=1;a<=nbValAj;a++){
|
||||
for(int b=1;b<=NBCOL;b++){
|
||||
for(int a=1;a<=nbValAj;a++){//pour chaque case de chaque ligne ajoutée, on va ajouter la valeur
|
||||
for(int b=1;b<=NBCOL;b++){//dans la declaration preparee, pour eviter les injections sql
|
||||
if((b>1&&b<5)||b==11||b==25){
|
||||
System.out.println("a: "+a+" et b: "+b);
|
||||
ps.setString((a-1)*25+b, mesS[a][b]);
|
||||
|
||||
}
|
||||
else if(j > 12 && j < 24 && j % 2 == 1){
|
||||
else if(b > 12 && b < 24 && b % 2 == 1){
|
||||
System.out.println("a: "+a+" et b: "+b);
|
||||
ps.setString((a-1)*25+b, mesD[a][b]+"");
|
||||
}
|
||||
|
|
@ -587,32 +547,14 @@ public class DataBase {
|
|||
}
|
||||
}
|
||||
}
|
||||
//conn.close();
|
||||
ps.executeQuery();
|
||||
ps.executeQuery();//puis on execute la requete
|
||||
System.out.println("update validee");
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
System.out.println("oskour into update");
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
|
||||
}
|
||||
/*System.out.println(sql);
|
||||
if (nbValAj>0) {//on effectue la requete si on a des maj a faire
|
||||
try {
|
||||
conn = this.getConnection();
|
||||
if (conn != null) {
|
||||
stmt = conn.createStatement();
|
||||
stmt.executeQuery(sql);
|
||||
conn.commit();
|
||||
//conn.close();
|
||||
System.out.println("update validee");
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
System.out.println("oskour into update");
|
||||
System.out.println(e.getMessage());
|
||||
}
|
||||
}*/
|
||||
}
|
||||
} catch (SQLException e) {
|
||||
System.out.println("oskour update");
|
||||
|
|
@ -621,8 +563,8 @@ public class DataBase {
|
|||
return sql;
|
||||
}
|
||||
|
||||
public void removeLines() throws FileNotFoundException{
|
||||
String sql="delete from myny.Test_Table where annee_numero_de_tirage >2017027";
|
||||
public void removeLines(int i) throws FileNotFoundException{
|
||||
String sql="delete from myny.Test_Table where annee_numero_de_tirage >"+i;
|
||||
try {
|
||||
conn = this.getConnection();
|
||||
if(conn!=null) {
|
||||
|
|
|
|||
|
|
@ -16,14 +16,14 @@ class DataBaseTest {
|
|||
DataBase maDB=new DataBase();
|
||||
Connection maCo=maDB.getConnection();
|
||||
assertNotNull(maCo);
|
||||
//maDB.fillDataBase();
|
||||
maDB.fillDataBase();
|
||||
Statement stmt= maDB.conn.createStatement();
|
||||
ResultSet rs=stmt.executeQuery("SELECT Count(*) From myny.Test_Table");
|
||||
rs.next();
|
||||
long nbcolret= rs.getLong(1);
|
||||
//System.out.println("nb lignes (changer la ligne juste en dessous si on modifie le nb de lignes): "+rs.getInt("total"));
|
||||
System.out.println("nb lignes (changer la ligne juste en dessous si on modifie le nb de lignes): "+rs.getLong(1));
|
||||
assertEquals(1317,rs.getLong(1));
|
||||
assertEquals(1321,rs.getLong(1));
|
||||
}
|
||||
|
||||
@Test
|
||||
|
|
@ -72,7 +72,7 @@ class DataBaseTest {
|
|||
@Test
|
||||
public void removeLines() throws FileNotFoundException{
|
||||
DataBase maDB=new DataBase();
|
||||
maDB.removeLines();
|
||||
maDB.removeLines(0);
|
||||
}
|
||||
|
||||
@Test
|
||||
|
|
|
|||
Reference in a new issue