Hibernate exception -- could not execute update query

Question

I have the following method, using Hibernate, that's driving me nuts. It's not updating my database correctly, and I cannot see what the problem. Can anyone help me with this?

public boolean changePassword(String username, String password) {
    HttpServletRequest request = ServletActionContext.getRequest();
    SessionFactory sessionFactory = (SessionFactory) request.getSession()
            .getServletContext().getAttribute("sessionFactory");
    Session session = sessionFactory.openSession();

    try {
        request = ServletActionContext.getRequest();
        Query myQuery = session.createQuery("update Administrator "
                + "set password = " + password + " where username = "
                + username);
        if (myQuery.executeUpdate() == 1) {
            return true;
        }
    } catch (Exception e) {
        System.out.println(e.getMessage());
    }

    return false;
}

Here is what I have in my console:

Hibernate: update login set password=password1 where username=frank
could not execute update query

dseibert · Accepted Answer · 2011-03-22 23:51:25Z

3

Try using parametrized queries to solve this issue.

Query myQuery = session.createQuery("update Administrator "
                + "set password = :password where username = :username");

I think the code for setting parameters is

myQuery.setParameter("username", username);

myQuery.setParameter("password", password);

answered Mar 22, 2011 at 23:51

dseibert

1,3299 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Bozho Over a year ago

+1. If not using parameterized query an sql injection is knocking on the door.

julx · Accepted Answer · 2011-03-22 23:50:28Z

0

Shouldn't be the parameter values escaped? Also: why don't you use setParameter() instead of constructing the whole query by hand? It will do all the necessary escaping for you. The code could be then:

Query q = session.createQuery("update Administrator set password =\
                               :password where username = :username");
q.setParameter("password", password);
q.setParameter("username", username);

answered Mar 22, 2011 at 23:50

julx

9,1728 gold badges53 silver badges88 bronze badges

Collectives™ on Stack Overflow

Hibernate exception -- could not execute update query

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related