diff --git a/src/main/java/hawk/service/SearchService.java b/src/main/java/hawk/service/SearchService.java index f9fe034..d0b0398 100644 --- a/src/main/java/hawk/service/SearchService.java +++ b/src/main/java/hawk/service/SearchService.java @@ -29,22 +29,11 @@ public List search(Search search) { @Override public List execute(Connection connection) throws SQLException { List items = new ArrayList<>(); - // The wrong way - String query = "select id, name, description from ITEM where description like '%" + - search.getSearchText() + "%'"; - - LOGGER.log(Level.INFO, "SQL Query: {0}", query);; - ResultSet rs = connection - .createStatement() - .executeQuery(query); - - /* The righter way, should probably use built in Data Model for this, but this is safe String query = "select id, name, description from ITEM where description like ?"; PreparedStatement statement = connection.prepareStatement(query); statement.setString(1, "%" + search.getSearchText() + "%"); LOGGER.log(Level.INFO, "SQL Query {0}", statement); ResultSet rs = statement.executeQuery(); - */ while (rs.next()) { items.add(new Item(rs.getLong("id"), rs.getString("name"), rs.getString("description")));