Skip to content

Bound the project search parameters instead of concatenating them #9

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
vagisha merged 1 commit into from
Sep 12, 2026
Merged

Bound the project search parameters instead of concatenating them #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 66 additions & 67 deletions src/org/yeastrc/project/ProjectsSearcher.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,9 @@ public List<Project> search() throws SQLException {
try {
boolean haveConstraint = false;

// One entry per ? in sqlStr, in the order the placeholders appear.
List<Object> params = new ArrayList<Object>();

String sqlStr = "SELECT DISTINCT P.projectID, P.projectSubmitDate ";
sqlStr += "FROM tblProjects AS P ";
sqlStr += "LEFT OUTER JOIN projectResearcher AS PR ON P.projectID = PR.projectID ";
Expand All @@ -53,93 +56,52 @@ public List<Project> search() throws SQLException {
if (this.types.size() > 0) {
sqlStr += " WHERE";
haveConstraint = true;

sqlStr += " (";

Iterator<String> iter = this.types.iterator();
String type = iter.next();
sqlStr += "P.projectType = '" + type + "'";
sqlStr += "P.projectType = ?";
params.add(iter.next());

while (iter.hasNext()) {
type = iter.next();
sqlStr += " OR P.projectType = '" + type + "'";
sqlStr += " OR P.projectType = ?";
params.add(iter.next());
}

sqlStr += ")";
}

// We have search tokens
// We have search tokens. A project has to match every one of them.
if (this.searchTokens.size() > 0) {
if (haveConstraint) {
sqlStr += " AND";
} else {
sqlStr += " WHERE";
haveConstraint = true;
}

Iterator<String> iter = this.searchTokens.iterator();
String tok = iter.next();

String tokSearchStr = "(RPI.researcherLastName LIKE '%" + tok + "%' OR ";
tokSearchStr += "RPI.researcherFirstName LIKE '%" + tok + "%' OR ";
tokSearchStr += "R.researcherLastName LIKE '%" + tok + "%' OR ";
tokSearchStr += "R.researcherFirstName LIKE '%" + tok + "%' OR ";
try
{
int projectId = Integer.parseInt(tok);
tokSearchStr += "P.projectID = " + projectId + " OR ";
}
catch(NumberFormatException ignored){}
tokSearchStr += "P.projectAbstract LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.publicAbstract LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectKeywords LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectProgress LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.scientificQuestion LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectTitle LIKE '%" + tok + "%')";


sqlStr += " (";

sqlStr += tokSearchStr;

sqlStr += " (";
sqlStr += tokenConstraint(iter.next(), params);

while (iter.hasNext()) {
tok = iter.next();
tokSearchStr = "(RPI.researcherLastName LIKE '%" + tok + "%' OR ";
tokSearchStr += "RPI.researcherFirstName LIKE '%" + tok + "%' OR ";
tokSearchStr += "R.researcherLastName LIKE '%" + tok + "%' OR ";
tokSearchStr += "R.researcherFirstName LIKE '%" + tok + "%' OR ";
try
{
int projectId = Integer.parseInt(tok);
tokSearchStr += "P.projectID = " + projectId + " OR ";
}
catch(NumberFormatException ignored){}
tokSearchStr += "P.projectAbstract LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.publicAbstract LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectKeywords LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectProgress LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.scientificQuestion LIKE '%" + tok + "%' OR ";
tokSearchStr += "P.projectTitle LIKE '%" + tok + "%')";

sqlStr += " AND " + tokSearchStr;
sqlStr += " AND " + tokenConstraint(iter.next(), params);
}

sqlStr += ")";
}

// Start date constraint
if (this.startDate != null) {
if (haveConstraint) { sqlStr += " AND"; }
else {
sqlStr += " WHERE";
haveConstraint = true;
}

String year = String.valueOf(this.startDate.getYear() + 1900);
String month = String.valueOf(this.startDate.getMonth() + 1);
String day = String.valueOf(this.startDate.getDate());

sqlStr += " P.projectSubmitDate >= '" + year + "-" + month + "-" + day + "'";

sqlStr += " P.projectSubmitDate >= ?";
params.add(new java.sql.Date(this.startDate.getTime()));
}

// End date constraint
Expand All @@ -149,12 +111,9 @@ public List<Project> search() throws SQLException {
sqlStr += " WHERE";
haveConstraint = true;
}

String year = String.valueOf(this.endDate.getYear() + 1900);
String month = String.valueOf(this.endDate.getMonth() + 1);
String day = String.valueOf(this.endDate.getDate());

sqlStr += " P.projectSubmitDate <= '" + year + month + day + "'";

sqlStr += " P.projectSubmitDate <= ?";
params.add(new java.sql.Date(this.endDate.getTime()));
}

// Archived constraint
Expand All @@ -169,8 +128,11 @@ public List<Project> search() throws SQLException {
}

sqlStr += " ORDER BY P.projectSubmitDate";

stmt = conn.prepareStatement(sqlStr);
for (int i = 0; i < params.size(); i++) {
stmt.setObject(i + 1, params.get(i));
}
rs = stmt.executeQuery();

while (rs.next()) {
Expand Down Expand Up @@ -252,6 +214,43 @@ public List<Project> search() throws SQLException {
return retList;
}

/**
* The columns one search word is matched against.
*/
private static final String[] TOKEN_COLUMNS = {
"RPI.researcherLastName", "RPI.researcherFirstName",
"R.researcherLastName", "R.researcherFirstName",
"P.projectAbstract", "P.publicAbstract", "P.projectKeywords",
"P.projectProgress", "P.scientificQuestion", "P.projectTitle"
};

/**
* A parenthesised OR over TOKEN_COLUMNS for one search word. A word that parses as an
* integer also matches that project ID.
*
* Adds one entry to params for each ? it returns, in the same order.
*/
private String tokenConstraint(String tok, List<Object> params) {

StringBuilder constraint = new StringBuilder("(");

for (int i = 0; i < TOKEN_COLUMNS.length; i++) {
if (i > 0) { constraint.append(" OR "); }
constraint.append(TOKEN_COLUMNS[i]).append(" LIKE ?");
params.add("%" + tok + "%");
}

try {
int projectId = Integer.parseInt(tok);
constraint.append(" OR P.projectID = ?");
params.add(projectId);
}
catch (NumberFormatException ignored) {}

constraint.append(")");
return constraint.toString();
}

/**
* Add a new word to use for searching
* @param phrase The phrase to add
Expand Down
10 changes: 10 additions & 0 deletions src/org/yeastrc/www/project/SearchProjectsAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
import org.yeastrc.project.ProjectReviewerDAO;
import org.yeastrc.project.ProjectsSearcher;
import org.yeastrc.project.Researcher;
import org.yeastrc.www.user.Groups;
import org.yeastrc.www.user.User;
import org.yeastrc.www.user.UserUtils;
/**
Expand Down Expand Up @@ -61,6 +62,15 @@ public ActionForward execute( ActionMapping mapping,
return mapping.findForward("authenticate");
}

// The link to this page is on the ADMIN menu only, so the action restricts it too.
Groups groupMan = Groups.getInstance();
if (!groupMan.isMember(user.getResearcher().getID(), "administrators")) {
ActionErrors errors = new ActionErrors();
errors.add("access", new ActionMessage("error.access.invalidgroup"));
saveErrors( request, errors );
return mapping.findForward("standardHome");
}

// The Researcher
Researcher researcher = user.getResearcher();

Expand Down
9 changes: 9 additions & 0 deletions src/org/yeastrc/www/project/SortProjectSearchAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,15 @@ public ActionForward execute( ActionMapping mapping,
return mapping.findForward("authenticate");
}

// The link to this page is on the ADMIN menu only, so the action restricts it too.
Groups groupMan = Groups.getInstance();
if (!groupMan.isMember(user.getResearcher().getID(), "administrators")) {
ActionErrors errors = new ActionErrors();
errors.add("access", new ActionMessage("error.access.invalidgroup"));
saveErrors( request, errors );
return mapping.findForward("standardHome");
}

// Make sure we have the pre-existing list of projects from their previous search
// We can have two types of projects: Subsidized projects and Billed projects

Expand Down