Question

first of all, a preface: I’m writing a java class that creates temporary tables on a database using jdbc. I’m using JSE6 and Oracle 11XE as a test DB, but the class needs to be also DB2 compliant.

The temporary tables I’m trying to create come from a bigger one, and I do some filtering and aggregations on the data. The parameters I base my filtering on are decided by the user at runtime. One simplified example of what I’m trying to do is this:

CREATE TABLE temp_table AS (
    SELECT
           table1.department_id,
           SUM(CASE WHEN table1.number_1 < &1 THEN table1.number_1 ELSE 0 END)) AS column1              
    FROM
           table1
    GROUP BY table1.department_id
)

My problem is that I need to specify parameters to filter the data, and I need to be sure they’re properly escaped/localized/typed. This would be easy using a prepared statement, but I cannot use bind variables with DDL.
The temporary solution I resorted to is to alter the query String myself, writing the parameters in the correct place, but this means I now have to implement all the checks instead of relying on a PreparedStatement object to do it for me, on top of losing all the other benefits.

I investigated other solutions, but none of them convinced me so far:

1. I could first create an empty temp_table and then fill it with INSERT INTO temp_table(id, column1) (SELECT …) but it seems I might incur in performance loss, so I’d like to stick to the CREATE temp_table AS

2. I thought about creating a temporary statement to hold the inner SELECT query, and have it generate a properly formatted/localized/etc. query string, but I haven’t found any way to obtain the final query from it (and I read it’s definitely not possible here). The only option I found for this case is to use DebuggableStatement, but I’m not sure I can include it in the project (also, it seems a quite inelegant way of solving my problem)

3. Another solution I’m thinking of, is to simply put the queries that create the temporary tables (for each of them I’d put the whole CREATE AS (SELECT…) on the database, inside a procedure, which I’ll then be able to call using CallableStatement. this way I could avoid handling typization and still have good performances, at the price of a tighter coupling with the db (I’d have to be sure the procedures are there, or manage in java their addition/removal from the db)

So, my question is: are there better alternatives than the ones I could think of?

Answer 1

Is this supposed to be database agnostic, or are you targeting for only Oracle? You don’t have to store PL/SQL in a stored procedure to use it; just build an anonymous PL/SQL block that does what you need, and execute it. The anonymous PL/SQL block can be built dynamically so that strongly typed variables are declared in the PL/SQL to hold your parameters, and then your java code sticks the values in. The type safety wouldn’t be handled by Java since you’re just building a string; it would be handled by Oracle when you execute the anonymous PL/SQL block.