{"comment":{"url":"https://api.github.com/repos/AuthMe-Team/AuthMeReloaded/comments/15192218","html_url":"https://github.com/AuthMe-Team/AuthMeReloaded/commit/da1adb632ecfb4e891dd11f8a969ba338fd37cfd#commitcomment-15192218","id":15192218,"user":{"login":"ljacqu","id":8417009,"avatar_url":"https://avatars.githubusercontent.com/u/8417009?v=3","gravatar_id":"","url":"https://api.github.com/users/ljacqu","html_url":"https://github.com/ljacqu","followers_url":"https://api.github.com/users/ljacqu/followers","following_url":"https://api.github.com/users/ljacqu/following{/other_user}","gists_url":"https://api.github.com/users/ljacqu/gists{/gist_id}","starred_url":"https://api.github.com/users/ljacqu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ljacqu/subscriptions","organizations_url":"https://api.github.com/users/ljacqu/orgs","repos_url":"https://api.github.com/users/ljacqu/repos","events_url":"https://api.github.com/users/ljacqu/events{/privacy}","received_events_url":"https://api.github.com/users/ljacqu/received_events","type":"User","site_admin":false},"position":null,"line":null,"path":"","commit_id":"da1adb632ecfb4e891dd11f8a969ba338fd37cfd","created_at":"2015-12-29T16:35:39Z","updated_at":"2015-12-29T16:35:39Z","body":"The diff shows what I mean. Before I knew what the query did, now I have to string it together and it's hidden in a combination of method and constructor calls.\r\n\r\n```diff\r\n-            pst = con.prepareStatement(\"SELECT * FROM \" + tableName + \";\");\r\n-            rs = pst.executeQuery();\r\n+        \tPreparedStatement st = getConnection().prepareStatement(new Query(this)\r\n+            \t\t.select(\"*\")\r\n+            \t\t.from(tableName)\r\n+            \t\t.build()\r\n+            \t\t.getQuery());\r\n+            ResultSet rs = st\r\n+            \t\t.executeQuery();\r\n```\r\n\r\n---\r\n\r\nAlso, this change is not OK. `newOne` and `oldOne` should be added with the prepared statement `setString` method for safety, now it's prone to SQL injection again.\r\n\r\n```diff\r\n-            String sql = \"UPDATE \" + tableName + \" SET \" + columnName + \"=? WHERE \" + columnName + \"=?;\";\r\n-            PreparedStatement pst = con.prepareStatement(sql);\r\n-            pst.setString(1, newOne);\r\n-            pst.setString(2, oldOne);\r\n+            PreparedStatement pst =\r\n+            \t\tcon.prepareStatement(new Query(this)\r\n+            \t\t.update()\r\n+            \t\t.from(tableName)\r\n+            \t\t.addUpdateSet(columnName + \"='\" + newOne + \"'\")\r\n+            \t\t.addWhere(columnName + \"='\" + oldOne + \"'\", null)\r\n+            \t\t.build()\r\n+            \t\t.getQuery());\r\n```"}}