[CAUSEWAY-10] Properly use prepared statements instead of injecting values into "insert" and "update" SQL statements

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 0.1.2-incubating
• Fix Version/s: 0.2.0-incubating
• Component/s: ZZZ Mothballed: Objectstore: SQL
• Assignee: Kevin Meyer
• Reporter: Kevin Meyer
• Created: 05/Nov/10 10:20
• Updated: 05/Jan/12 08:22
• Resolved: 10/Sep/11 20:20

Description

At the moment, all "insert" and "update" commands use a fully formed SQL string with embedded values:
"insert into SQLDATACLASS (PK_ID, color,date_time) values (2252, '0','2010-03-05 22:23:000000')".

This should be updated to "insert into SQLDATACLASS (PK_ID, color,date_time) values (?,?,?)".

This should also solve issues with quoting values such as (especially affecting DB2) quoting integer, float, etc, non-string values. DB2 is throwing an exception when integers and floats are quoted ('1') instead of (1).