Using PreparedStatements instead of normal Statements (#99)

src/me/ryanhamshire/GriefPrevention/DatabaseDataStore.java

@@ -20,13 +20,10 @@ package me.ryanhamshire.GriefPrevention;
 
 import java.io.PrintWriter;
 import java.io.StringWriter;
-import java.sql.Connection;
+import java.sql.*;
-import java.sql.DriverManager;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.sql.Statement;
 import java.text.SimpleDateFormat;
 import java.util.*;
+import java.util.Date;
 
 import org.bukkit.*;
 
@@ -39,6 +36,19 @@ public class DatabaseDataStore extends DataStore
 	private String userName;
 	private String password;
 
+	private String updateNameSQL;
+	private String insertClaimSQL;
+	private String deleteClaimSQL;
+	private String getPlayerDataSQL;
+	private String deletePlayerDataSQL;
+	private String insertPlayerDataSQL;
+	private String insertNextClaimIdSQL;
+	private String deleteGroupBonusSQL;
+	private String insertSchemaVerSQL;
+	private String deleteNextClaimIdSQL;
+	private String deleteSchemaVersionSQL;
+	private String selectSchemaVersionSQL;
+
 	DatabaseDataStore(String url, String userName, String password) throws Exception
 	{
 		this.databaseUrl = url;
@@ -106,6 +116,19 @@ public class DatabaseDataStore extends DataStore
 			throw e3;
 		}
 
+		this.updateNameSQL = "UPDATE griefprevention_playerdata SET name = ? WHERE name = ?;";
+		this.insertClaimSQL = "INSERT INTO griefprevention_claimdata (id, owner, lessercorner, greatercorner, builders, containers, accessors, managers, inheritnothing, parentid) VALUES(?,?,?,?,?,?,?,?,?,?);";
+		this.deleteClaimSQL = "DELETE FROM griefprevention_claimdata WHERE id=?;";
+		this.getPlayerDataSQL = "SELECT * FROM griefprevention_playerdata WHERE name=?;";
+		this.deletePlayerDataSQL = "DELETE FROM griefprevention_playerdata WHERE name=?;";
+		this.insertPlayerDataSQL = "INSERT INTO griefprevention_playerdata (name, lastlogin, accruedblocks, bonusblocks) VALUES (?,?,?,?);";
+		this.insertNextClaimIdSQL = "INSERT INTO griefprevention_nextclaimid VALUES (?);";
+		this.deleteGroupBonusSQL = "DELETE FROM griefprevention_playerdata WHERE name=?;";
+		this.insertSchemaVerSQL = "INSERT INTO griefprevention_schemaversion VALUES (?)";
+		this.deleteNextClaimIdSQL = "DELETE FROM griefprevention_nextclaimid;";
+		this.deleteSchemaVersionSQL = "DELETE FROM griefprevention_schemaversion;";
+		this.selectSchemaVersionSQL = "SELECT * FROM griefprevention_schemaversion;";
+
 		//load group data into memory
 		Statement statement = databaseConnection.createStatement();
 		ResultSet results = statement.executeQuery("SELECT * FROM griefprevention_playerdata;");
@@ -205,10 +228,10 @@ public class DatabaseDataStore extends DataStore
 
 				for(String name : changes.keySet())
 				{
-                    try
+					try (PreparedStatement updateStmnt = this.databaseConnection.prepareStatement(this.getUpdateNameSQL())) {
-                    {
+						updateStmnt.setString(1, changes.get(name).toString());
-                        statement = this.databaseConnection.createStatement();
+						updateStmnt.setString(2, name);
-                        statement.execute("UPDATE griefprevention_playerdata SET name = '" + changes.get(name).toString() + "' WHERE name = '" + name + "';");
+						updateStmnt.executeUpdate();
 					}
 					catch(SQLException e)
 					{
@@ -231,8 +254,8 @@ public class DatabaseDataStore extends DataStore
 			statement.execute("ALTER TABLE griefprevention_claimdata ADD inheritNothing BOOLEAN DEFAULT 0 AFTER managers;");
 		}
 
-		
 		//load claims data into memory
+
 		results = statement.executeQuery("SELECT * FROM griefprevention_claimdata;");
 
 		ArrayList<Claim> claimsToRemove = new ArrayList<Claim>();
@@ -250,7 +273,6 @@ public class DatabaseDataStore extends DataStore
 				long parentId = results.getLong("parentid");
 				claimID = results.getLong("id");
 				boolean inheritNothing = results.getBoolean("inheritNothing");
-					
 				Location lesserBoundaryCorner = null;
 				Location greaterBoundaryCorner = null;
 				String lesserCornerString = "(location not available)";
@@ -258,7 +280,6 @@ public class DatabaseDataStore extends DataStore
 				{
 					lesserCornerString = results.getString("lessercorner");
 					lesserBoundaryCorner = this.locationFromString(lesserCornerString, validWorlds);
-					
 					String greaterCornerString = results.getString("greatercorner");
 					greaterBoundaryCorner = this.locationFromString(greaterCornerString, validWorlds);
 				}
@@ -321,7 +342,6 @@ public class DatabaseDataStore extends DataStore
 				String managersString = results.getString("managers");
 				List<String> managerNames = Arrays.asList(managersString.split(";"));
 				managerNames = this.convertNameListToUUIDList(managerNames);
-				
 				Claim claim = new Claim(lesserBoundaryCorner, greaterBoundaryCorner, ownerID, builderNames, containerNames, accessorNames, managerNames, inheritNothing, claimID);
 
 				if(removeClaim)
@@ -365,9 +385,9 @@ public class DatabaseDataStore extends DataStore
 			childClaim.inDataStore = true;
 		}
 
-		for(int i = 0; i < claimsToRemove.size(); i++)
+		for(Claim claim : claimsToRemove)
 		{
-			this.deleteClaimFromSecondaryStorage(claimsToRemove.get(i));
+			this.deleteClaimFromSecondaryStorage(claim);
 		}
 
 		if(this.getSchemaVersion() <= 2)
@@ -415,59 +435,26 @@ public class DatabaseDataStore extends DataStore
 
 		claim.getPermissions(builders, containers, accessors, managers);
 
-		String buildersString = "";
+		String buildersString = this.storageStringBuilder(builders);
-		for(int i = 0; i < builders.size(); i++)
+		String containersString = this.storageStringBuilder(containers);
-		{
+		String accessorsString = this.storageStringBuilder(accessors);
-			buildersString += builders.get(i) + ";";
+		String managersString = this.storageStringBuilder(managers);
-		}
-		
-		String containersString = "";
-		for(int i = 0; i < containers.size(); i++)
-		{
-			containersString += containers.get(i) + ";";
-		}
-		
-		String accessorsString = "";
-		for(int i = 0; i < accessors.size(); i++)
-		{
-			accessorsString += accessors.get(i) + ";";
-		}
-
-		String managersString = "";
-		for(int i = 0; i < managers.size(); i++)
-		{
-			managersString += managers.get(i) + ";";
-		}
-		
 		boolean inheritNothing = claim.getSubclaimRestrictions();
+		long parentId = claim.parent == null ? -1 : claim.parent.id;
 
-		long parentId;
+		try (PreparedStatement insertStmt = this.databaseConnection.prepareStatement(this.getInsertClaimSQL())) {
-		if(claim.parent == null)
-		{
-			parentId = -1;
-		}
-		else
-		{
-			parentId = claim.parent.id;
-		}
 
-		try
+			insertStmt.setLong(1, claim.id);
-		{
+			insertStmt.setString(2, owner);
-			this.refreshDataConnection();
+			insertStmt.setString(3, lesserCornerString);
-			
+			insertStmt.setString(4, greaterCornerString);
-			Statement statement = databaseConnection.createStatement();
+			insertStmt.setString(5, buildersString);
-			statement.execute("INSERT INTO griefprevention_claimdata (id, owner, lessercorner, greatercorner, builders, containers, accessors, managers, inheritnothing, parentid) VALUES(" +
+			insertStmt.setString(6, containersString);
-					claim.id + ", '" +
+			insertStmt.setString(7, accessorsString);
-					owner + "', '" +
+			insertStmt.setString(8, managersString);
-					lesserCornerString + "', '" +
+			insertStmt.setBoolean(9, inheritNothing);
-					greaterCornerString + "', '" +
+			insertStmt.setLong(10, parentId);
-					buildersString + "', '" +
+			insertStmt.executeUpdate();
-					containersString + "', '" +
-					accessorsString + "', '" +
-					managersString + "', " +
-					inheritNothing + ", "+
-					parentId +
-					");");
 		}
 		catch(SQLException e)
 		{
@@ -480,13 +467,9 @@ public class DatabaseDataStore extends DataStore
 	@Override
 	synchronized void deleteClaimFromSecondaryStorage(Claim claim)
 	{
-	    try
+		try(PreparedStatement deleteStmnt = this.databaseConnection.prepareStatement(this.getDeleteClaimSQL())) {
-		{
+			deleteStmnt.setLong(1, claim.id);
-			this.refreshDataConnection();
+			deleteStmnt.executeUpdate();
-
-						
-			Statement statement = this.databaseConnection.createStatement();
-			statement.execute("DELETE FROM griefprevention_claimdata WHERE id='" + claim.id + "';");
 		}
 		catch(SQLException e)
 		{
@@ -502,12 +485,10 @@ public class DatabaseDataStore extends DataStore
 		PlayerData playerData = new PlayerData();
 		playerData.playerID = playerID;
 
-		try
+		try (PreparedStatement selectStmnt = this.databaseConnection.prepareStatement( this.getGetPlayerDataSQL()))
 		{
-			this.refreshDataConnection();
+			selectStmnt.setString(1, playerID.toString());
-			
+			ResultSet results = selectStmnt.executeQuery();
-			Statement statement = this.databaseConnection.createStatement();
-			ResultSet results = statement.executeQuery("SELECT * FROM griefprevention_playerdata WHERE name='" + playerID.toString() + "';");
 
 			//if data for this player exists, use it
 			if(results.next())
@@ -538,18 +519,20 @@ public class DatabaseDataStore extends DataStore
 
 	private void savePlayerData(String playerID, PlayerData playerData)
 	{
-		try
+		try (PreparedStatement deleteStmnt = this.databaseConnection.prepareStatement(this.getDeletePlayerDataSQL());
-		{
+			 PreparedStatement insertStmnt = this.databaseConnection.prepareStatement(this.getInsertPlayerDataSQL())) {
-			this.refreshDataConnection();
 			OfflinePlayer player = Bukkit.getOfflinePlayer(UUID.fromString(playerID));
 
 			SimpleDateFormat sqlFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
 			String dateString = sqlFormat.format(new Date(player.getLastPlayed()));
+			deleteStmnt.setString(1, playerID);
+			deleteStmnt.executeUpdate();
 
-			Statement statement = databaseConnection.createStatement();
+			insertStmnt.setString(1, playerID);
-			statement.execute("DELETE FROM griefprevention_playerdata WHERE name='" + playerID.toString() + "';");
+			insertStmnt.setString(2, dateString);
-			statement = databaseConnection.createStatement();
+			insertStmnt.setInt(3, playerData.getAccruedClaimBlocks());
-			statement.execute("INSERT INTO griefprevention_playerdata (name, lastlogin, accruedblocks, bonusblocks) VALUES ('" + playerID.toString() + "', '" + dateString + "', " + playerData.getAccruedClaimBlocks() + ", " + playerData.getBonusClaimBlocks() + ");");
+			insertStmnt.setInt(4, playerData.getBonusClaimBlocks());
+			insertStmnt.executeUpdate();
 		}
 		catch(SQLException e)
 		{
@@ -570,13 +553,11 @@ public class DatabaseDataStore extends DataStore
 	{
 		this.nextClaimID = nextID;
 
-		try
+		try (PreparedStatement deleteStmnt = this.databaseConnection.prepareStatement(this.getDeleteNextClaimIdSQL());
-		{
+			 PreparedStatement insertStmnt = this.databaseConnection.prepareStatement(this.getInsertNextClaimIdSQL())) {
-			this.refreshDataConnection();
+			deleteStmnt.execute();
-			
+			insertStmnt.setLong(1, nextID);
-			Statement statement = databaseConnection.createStatement();
+			insertStmnt.executeUpdate();
-			statement.execute("DELETE FROM griefprevention_nextclaimid;");
-			statement.execute("INSERT INTO griefprevention_nextclaimid VALUES (" + nextID + ");");
 		}
 		catch(SQLException e)
 		{
@@ -590,17 +571,18 @@ public class DatabaseDataStore extends DataStore
 	synchronized void saveGroupBonusBlocks(String groupName, int currentValue)
 	{
 		//group bonus blocks are stored in the player data table, with player name = $groupName
-	    try
+		try (PreparedStatement deleteStmnt = this.databaseConnection.prepareStatement(this.getDeleteGroupBonusSQL());
-        {
+			 PreparedStatement insertStmnt = this.databaseConnection.prepareStatement(this.getInsertPlayerDataSQL())) {
-            this.refreshDataConnection();
-            
 			SimpleDateFormat sqlFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
 			String dateString = sqlFormat.format(new Date());
+			deleteStmnt.setString(1, '$' + groupName);
+			deleteStmnt.executeUpdate();
 
-            Statement statement = databaseConnection.createStatement();
+			insertStmnt.setString(1, '$' + groupName);
-            statement.execute("DELETE FROM griefprevention_playerdata WHERE name='$" + groupName + "';");
+			insertStmnt.setString(2, dateString);
-            statement = databaseConnection.createStatement();
+			insertStmnt.setInt(3, 0);
-            statement.execute("INSERT INTO griefprevention_playerdata (name, lastlogin, accruedblocks, bonusblocks) VALUES ('$" + groupName + "', '" + dateString + "', " + "0" + ", " + String.valueOf(currentValue) + ");");
+			insertStmnt.setInt(4, currentValue);
+			insertStmnt.executeUpdate();
 		}
 		catch(SQLException e)
 		{
@@ -651,12 +633,8 @@ public class DatabaseDataStore extends DataStore
 	@Override
 	protected int getSchemaVersionFromStorage()
 	{
-        try
+		try (PreparedStatement selectStmnt = this.databaseConnection.prepareStatement(this.getSelectSchemaVersionSQL())) {
-        {
+			ResultSet results = selectStmnt.executeQuery();
-            this.refreshDataConnection();
-            
-            Statement statement = this.databaseConnection.createStatement();
-            ResultSet results = statement.executeQuery("SELECT * FROM griefprevention_schemaversion;");
 
 			//if there's nothing yet, assume 0 and add it
 			if(!results.next())
@@ -664,13 +642,11 @@ public class DatabaseDataStore extends DataStore
 				this.setSchemaVersion(0);
 				return 0;
 			}
-            
 			//otherwise return the value that's in the table
 			else
 			{
 				return results.getInt("version");
 			}
-            
 		}
 		catch(SQLException e)
 		{
@@ -684,13 +660,12 @@ public class DatabaseDataStore extends DataStore
 	@Override
 	protected void updateSchemaVersionInStorage(int versionToSet)
 	{
-        try
+		try (PreparedStatement deleteStmnt = this.databaseConnection.prepareStatement(this.getDeleteSchemaVersionSQL());
-        {
+			 PreparedStatement insertStmnt = this.databaseConnection.prepareStatement(this.getInsertSchemaVerSQL())) {
-            this.refreshDataConnection();
+			deleteStmnt.execute();
 
-            Statement statement = databaseConnection.createStatement();
+			insertStmnt.setInt(1, versionToSet);
-            statement.execute("DELETE FROM griefprevention_schemaversion;");
+			insertStmnt.executeUpdate();
-            statement.execute("INSERT INTO griefprevention_schemaversion VALUES (" + versionToSet + ");");
 		}
 		catch(SQLException e)
 		{
@@ -698,4 +673,65 @@ public class DatabaseDataStore extends DataStore
 			GriefPrevention.AddLogEntry(e.getMessage());
 		}
 	}
+
+	/**
+	 * Concats an array to a string divided with the ; sign
+	 * @param input Arraylist with strings to concat
+	 * @return String with all values from input array
+	 */
+	private String storageStringBuilder(ArrayList<String> input) {
+		String output = "";
+		for(String string : input) {
+			output += string + ";";
+		}
+		return output;
+	}
+
+	public String getUpdateNameSQL() {
+		return updateNameSQL;
+	}
+
+	public String getInsertClaimSQL() {
+		return insertClaimSQL;
+	}
+
+	public String getDeleteClaimSQL() {
+		return deleteClaimSQL;
+	}
+
+	public String getGetPlayerDataSQL() {
+		return getPlayerDataSQL;
+	}
+
+	public String getDeletePlayerDataSQL() {
+		return deletePlayerDataSQL;
+	}
+
+	public String getInsertPlayerDataSQL() {
+		return insertPlayerDataSQL;
+	}
+
+	public String getInsertNextClaimIdSQL() {
+		return insertNextClaimIdSQL;
+	}
+
+	public String getDeleteGroupBonusSQL() {
+		return deleteGroupBonusSQL;
+	}
+
+	public String getInsertSchemaVerSQL() {
+		return insertSchemaVerSQL;
+	}
+
+	public String getDeleteNextClaimIdSQL() {
+		return deleteNextClaimIdSQL;
+	}
+
+	public String getDeleteSchemaVersionSQL() {
+		return deleteSchemaVersionSQL;
+	}
+
+	public String getSelectSchemaVersionSQL() {
+		return selectSchemaVersionSQL;
+	}
 }