When using Hash Variable that uses URL parameter or user-inputted value in the SQL query, ensure that these hash variable(s) are escaped in the query! Make use of hash variable escape keywords, see Hash Variable - Escaping the Resultant Hash Variable. Example of VULNERABLE query: SELECT * FROM app_fd_sample_table WHERE c_value = '#requestParam.id#' To fix this, use ?sql hash variable escape: SELECT * FROM app_fd_sample_table WHERE c_value = '#requestParam.id?sql#' |
JDBC Datalist Action allows you to perform SQL queries on one (a row action) or more records (a bulk action) in your datalist. You can specify which database to perform the SQL function, either the current Joget database (default datasource) or a custom datasource (external database).
JDBC Datalist Action can be used to delete records or perform an update on one or more records based on user selection in the datalist checkboxes.
Name | Description | Screens (Click to view) | ||||||
---|---|---|---|---|---|---|---|---|
Label | Datalist button label. | Figure 1 : JDBC Action Menu Figure 2 : JDBC Datalist Action | ||||||
Confirmation Message | Confirmation message before performing action, for example "Are you sure?". | |||||||
Datasource | Target database to execute SQL statements on. Choices:-
| |||||||
Custom JDBC Driver | JDBC driver name. Example values:
Only applicable to "Custom Datasource" option. | |||||||
Custom JDBC URL | Database connection URL. Example: jdbc:mysql://localhost:3306/jwdb Only applicable to "Custom Datasource" option. | |||||||
Custom JDBC Username | Database username. Example: root Only applicable to "Custom Datasource" option. | |||||||
Custom JDBC Password | Specified database user's password. Only applicable to "Custom Datasource" option.
| |||||||
Query |
Insert your SQL statement here. Use syntax like {id} in query to inject the selected row key. Use {uuid} to generate a unique id (or primary key). Examples:
|
APP_datalist_using_jdbc_dx_kb.jwa