jOOQ supports a vast amount of SQL syntax out of the box. As such, most users will not think of resorting to string concatenation like in the old days when writing dynamic SQL with JDBC.
But every now and then, a vendor specific feature is not supported by jOOQ (yes, it happens). In that case, jOOQ supports a variety of “plain SQL” API, which can be used to construct almost all types of jOOQ API elements, such as:
But then, sometimes, you need to pass an argument to such a function dynamically, such as another column expression. And you want to do that in a type safe way, because the jOOQ code generator already produced type safe column expressions. So you might be inclined to concatenate, nonetheless:
Never do this!
For these reasons:
And if you’re doing this more often, you can factor out this call in your own mini DSL:
And now, call it like this:
As a rule of thumb:
With jOOQ, you should never need to resort to SQL string concatenation
You can always use either:
// Static import is implied, as always
import static org.jooq.impl.DSL.*;
// Column expressions
Field<String> f = field("cool_function(1, 2, 3)", String.class);
// Predicates
Condition c = condition("col1 <fancy operator> col2");
// Tables
Table<?> t = table("wicked_table_valued_function(x, y)");
field("cool_function(1, " + MY_TABLE.MY_COLUMN + ", 3)");
- Despite jOOQ being very SQL injection safe in general, this is where you can in fact introduce a plain SQL injection vulnerability nonetheless. Not in this case, as the column is generated code, but maybe, you will concatenate user input. Note that in order to increase SQL injection protection, plain SQL usage can be prevented globally, and allowed only locally when needed by adding our PlainSQL checker, using the checker framework or Google ErrorProne.
- As always with string concatenation, you’re prone to SQL syntax errors. In this case, the generated SQL is not specific to any dialect, as
MY_TABLE.MY_COLUMN.toString()is being called, without any contextual information, such as theSQLDialectand all the other configuration flags.
{0}, {1}, {2}:
field("cool_function(1, {0}, 3)", MY_TABLE.MY_COLUMN);
public static Field<String> coolFunction(Field<?> field) {
field("cool_function(1, {0}, 3)", field);
}
coolFunction(MY_TABLE.MY_COLUMN)
- The type safe jOOQ DSL API
- The plain SQL templating API (and ideally hide such usage behind your own type safe DSL API)