How to parameterize IN clause about azure-cosmosdb-java HOT 9 CLOSED

@zhouchong90 for IN (...) clause please try to avoid Parametrizing the query. Please just pass the query string without any parametrization.

from azure-cosmosdb-java.

Will it be suspect to SQL injections and attacks?

from azure-cosmosdb-java.

@zhouchong90
You can try something like this:

String query = "SELECT * from c where c.prop IN (@param1, @param2)";
SqlParameterCollection params = new SqlParameterCollection(new SqlParameter("@param1", 98), new SqlParameter("@param2", 99));
SqlQuerySpec sqs = new SqlQuerySpec(query, params);

from azure-cosmosdb-java.

@moderakh Thanks. Will there be any built-in support to take a list directly? Since I'll have a list of thousands of values and it'll be ugly to write a dynamically generate sql and put the values.

from azure-cosmosdb-java.

@zhouchong90 We have a simple library, where you can generate queries more effectively.
https://github.com/mohitgoyal91/azure-cosmosdb-querybuilder-java

For example in your case for query -> "SELECT * from c where c.prop IN (@param1, @Param2)"
Assuming you have a

List<Integer> list = new ArrayList<>();
list.add(98); list.add(99);

Simply call the below function:

new SelectQuery()
.in("prop", list.toArray())
.createQuery();

from azure-cosmosdb-java.

Cleaning up older issues.

No plans on support parameterized lists directly any time soon. Following Mohit's pattern makes sense and something we could potentially support ourselves in the future, but not a priority at the moment.

from azure-cosmosdb-java.

For node SDK based applications, I found that this way works as well.

sqlQuery: SqlQuerySpec = {
        query: 'SELECT * FROM t WHERE ARRAY_CONTAINS(@idList, t.id)',
        parameters: [
            {
                name: '@idList',
                value: ['id1','id2','id3'],
            },
        ],
    };

from azure-cosmosdb-java.

Just found this issue, absolutely perplexed that this is just silently not supported. Its not like the client libs are still 1.x early days. Combined with the fact that it is not possible to log the outgoing SQL queries, this just cost me several hours.

from azure-cosmosdb-java.

@ALL is this fixed ? What is the solution ? We really need this feature to pass list for in clause.. Can someone tell us the solution ?

from azure-cosmosdb-java.