|
|
|
| The following comment has been added to this issue: |
[ Permlink ] |
|
Author: Georges Racinet
Date: 25/06/07 11:09
Comment:
One could argue that stateless QMs actually provide the same functionality.
|
|
Currently client components find documents by forging a string query such as:
String myQuery = "SELECT * FROM document WHERE prefix1:field1 = 'value1' AND prefix2:field2 = 'value2'"
and then feeding it to:
documentManager.query(myQuery)
Which is bad since it's up to the client code to implement NXQL escaping (security protection against NXQL injection).
So the new API instead accept:
String myQuery = "SELECT * FROM document WHERE prefix1:field1 = ? AND prefix2:field2 = ?"
Object[] params = new {"value1", "value2"};
documentManager.query(myQuery, params);
and the NXQL escaping should be handled by the server as this is done with the PreparedStatement class of JDBC for instance.
|
|
|
|
![]() |
|
_______________________________________________
ECM-tickets mailing list
[email protected]
http://lists.nuxeo.com/mailman/listinfo/ecm-tickets
