Question

I am using Hibernate to access my database. I would like to delete a set of fields on function of a criteria. My database is PostgreSQL and my Java code is:

public void deleteAttr(String parameter){
    Configuration cfg = new Configuration();
    cfg.configure(resource.getString("hibernate_config_file"));
    SessionFactory sessionFactory = cfg.buildSessionFactory();
    session = sessionFactory.openSession(); 
    Transaction tx = session.beginTransaction();
    tx.begin();
    String sql = "delete from attribute where timestamp > to_date('"+parameter+"','YYYY-MM-DD')"
    session.createSQLQuery(sql);
    tx.commit();
}

The method runs, but it doesn’t delete data from database. I have also checked the sql sentence in PgAdmin and it works, but not in code. Why? Does someone help me?

Thanks in advance!

Answer 1

It’s because you’re creating a query, but you don’t execute it:

String sql = "delete from attribute where timestamp > to_date('"+parameter+"','YYYY-MM-DD')"
Query query = session.createSQLQuery(sql);
query.executeUpdate();

You should really use bound named parameters rather than string concatenation to pass parameters in your query: it’s usually more efficient, it’ much more robust, but above all, it doesn’t open the door to SQL injection attacks.