Q001

NO.43 Consider this method declaration:
void setSessionUser(Connection conn, String user) throws SQLException {
    Statement stmt = conn.createStatement();
    String sql =<EXPRESSION> ;
    stmt.execute();
}
A) "SET SESSION AUTHORIZATION " + user
B) "SET SESSION AUTHORIZATION " + stmt.enquoteIdentifier(user)
Is A or B the correct replacement for <EXPRESSION> and why?
A. A, because it sends exactly the value of user provided by the calling code.
B. B, because enquoting values provided by the calling code prevents SQL injection.
C. A and B are functionally equivalent.
D. A, because it is unnecessary to enclose identifiers in quotes.
E. B, because all values provided by the calling code should be enquoted.


Answer : B

Q002

NO.115 Given the Customer table structure:

* ID Number Primary Key
* NAME Text Nullable

Given code fragment:

12. PreparedStatement stmt = con.prepareStatement(
    "INSERT INTO CUSTOMER VALUES(?, ?)");
13. stmt.setInt(1, 42);
14. /* Insert code here */
15. int n = stmt.executeUpdate();

Which statement inserted on line 14 sets NAME column to a NULL value?

A. stmt.setNull(2, java.sql.Types.VARCHAR);
B. stmt.setNull(2, String.class);
C. stmt.setNull(2, null);
D. stmt.setNull(2, java.lang.String);


Answer: A

stmt.setInt(1, 42) 是將第一個欄位(ID) 設為 42。

第二個欄位要設為 Null 需使用 stmp.setNull(2, java.sql.Types.VARCHAR)