JDBC, servlets and JSP based applications notes — Unit 5

JDBC (Java Database Connectivity) is an API that allows Java applications to interact with relational databases (like MySQL, Oracle).

⇒1.1 The Architecture

JDBC is composed of two layers:

• JDBC API: The interfaces (`Connection`, `Statement`, `ResultSet`) that developers code against. Provided in the `java.sql` package.
• JDBC Driver API: The bridge between the standard Java API and the proprietary database protocol. Each database vendor (Oracle, MySQL) provides their own `.jar` driver file.

⇒2.1 The 4 Standard Steps

A standard `Statement` concatenates raw strings into SQL queries. This is highly vulnerable to SQL Injection.

⇒3.1 PreparedStatement

Precompiled by the database. It uses placeholders `?` and safely escapes all inputs. Always use PreparedStatement for variables.

⇒4.1 Execution Methods

• `executeQuery()`: Used for SELECT statements. Returns a `ResultSet`.
• `executeUpdate()`: Used for INSERT, UPDATE, DELETE. Returns an `int` (rows affected).

⇒4.2 Processing the ResultSet

The ResultSet acts like a cursor pointing before the first row of data.

By default, JDBC operates in Auto-Commit mode (every single query is committed immediately). For complex operations (like a bank transfer involving two accounts), this must be disabled.

⇒5.1 Manual Commits

A Servlet is a Java class that runs on a Web Server. It intercepts incoming HTTP requests from browsers, processes them (usually by hitting a database), and returns an HTTP response.

⇒6.1 Web Containers (Tomcat)

Servlets do not have a `main()` method. They are managed by a Web Container (like Apache Tomcat). The container handles the network socket connection, creates an HTTP Request object, and passes it to the Servlet.

The container manages the servlet through three main methods.

• `init()`: Called exactly once when the servlet is first loaded into memory. Used for heavy setup tasks (like opening DB connections).
• `service()`: Called for every single incoming HTTP request. In `HttpServlet`, this automatically delegates to `doGet()` or `doPost()`.
• `destroy()`: Called exactly once when the server is shutting down to release resources.

Crucially, there is only one instance of a given servlet class in memory. Multiple incoming user requests are handled concurrently by multiple threads calling the `service()` method on that single instance.

Almost all web servlets extend `HttpServlet`.

Because HTTP is stateless, Servlets must manually track users across multiple requests.

⇒9.1 HttpSession

The container automatically generates a unique Session ID, sends it to the browser as a Cookie, and intercepts it on subsequent requests.

When a Servlet finishes processing, it rarely outputs HTML directly. It usually passes control to a JSP file to render the UI.

⇒10.1 `RequestDispatcher.forward()`

Happens entirely on the server. The URL in the browser does not change. The request and response objects are passed directly to the next file.

⇒10.2 `response.sendRedirect()`

The server sends an HTTP 302 code to the browser. The browser makes a completely brand new HTTP GET request to the new URL. The URL bar changes. Original request data is lost.

Writing HTML using `out.println("<h1>")` inside a Servlet is a nightmare to maintain. JSP solves this by flipping the paradigm: it allows you to write standard HTML files, and embed snippets of Java code inside them.

⇒11.1 How JSP Works

JSP is an abstraction. The first time a browser requests `index.jsp`, Tomcat intercepts it, reads the file, completely translates it into a standard Java Servlet (`index_jsp.java`), compiles it, and runs it. Every subsequent request hits the compiled Servlet.

These are tags used to insert Java into the HTML.

• Scriptlet `<% code %>`: Inserts raw Java code into the `service()` method of the generated servlet.
• Expression `<%= data %>`: Evaluates the expression and outputs it to the HTML. (No semicolon at the end).
• Declaration `<%! code %>`: Declares variables or methods outside the `service()` method (as instance variables of the generated servlet).

⇒13.1 Directives `<%@ ... %>`

Used to give instructions to the container during the translation phase.

• `page`: Imports classes (`<%@ page import="java.util.List" %>`).
• `include`: Statically includes another file (like a header) before compilation.

⇒13.2 Implicit Objects

You don't need to declare these in a JSP; Tomcat provides them automatically inside scriptlets:

`request`, `response`, `session`, `out` (the PrintWriter).

Writing complex Java logic inside JSP scriptlets is considered a terrible anti-pattern (Spaghetti Code). The modern standard is MVC.

• Model (Java Beans/DAO): Plain Java classes that hold data and interact with the database via JDBC.
• Controller (Servlets): Receives the HTTP request, invokes the Model to get data, attaches the data to the request object, and forwards to a JSP.
• View (JSP): Only contains HTML and simple tags to display the data provided by the Controller.

To fully eradicate Java `<% %>` scriptlets from JSPs, EL and JSTL were introduced.

⇒15.1 Expression Language (EL)

Syntax: `${...}`. It cleanly retrieves attributes set by the Servlet.

⇒15.2 JSTL (JSP Standard Tag Library)

Provides XML-like tags for logic (loops, if-statements).

While Servlets are the foundation of Java Web, developers rarely write raw Servlets today. They use frameworks built on top of the Servlet API.

⇒16.1 Spring Boot

The industry standard. It provides an embedded Tomcat server and an abstraction layer called Spring MVC.

• Uses annotations (`@RestController`, `@GetMapping`) instead of extending `HttpServlet`.
• Returns JSON automatically instead of manual `PrintWriter` manipulation.
• Uses Spring Data JPA (Hibernate) instead of raw JDBC queries.

EJB is a legacy server-side software architecture that encapsulates business logic. While mostly replaced by Spring today, it remains in university syllabi.

⇒17.1 Types of Beans

• Stateless Session Beans: Do not maintain conversational state with the client. (E.g., A math calculator bean).
• Stateful Session Beans: Maintain state across multiple requests for a single client. (E.g., A shopping cart bean).
• Message-Driven Beans: Triggered asynchronously by incoming JMS (Java Message Service) messages.

Opening a new database connection via JDBC is extremely slow (network handshakes, authentication). If 1,000 users connect, opening 1,000 connections will crash the database.

⇒18.1 The Solution

A Connection Pool (like HikariCP) opens a fixed number of connections (e.g., 20) when the server starts. When a Servlet needs the DB, it 'borrows' a connection from the pool. When finished, it 'returns' it to the pool instead of closing it.

⇒19.1 Preventing SQL Injection

As discussed, ALWAYS use `PreparedStatement` instead of `Statement`.

⇒19.2 Preventing XSS

When displaying user input via JSP, always escape it. JSTL's `<c:out value="${user.comment}" />` automatically escapes HTML characters, preventing malicious JavaScript from executing.

⇒19.3 Filter API

A Servlet Filter sits in front of the Servlets. It intercepts every request and response. It is used for tasks like checking if a valid Session exists before allowing access to a secure URL.

The concepts learned in this unit map directly to modern architecture:

• Raw JDBC evolved into ORMs (Hibernate) and Spring Data JPA.
• Raw Servlets evolved into Spring MVC Controllers (`@RestController`).
• JSP (Server-Side Rendering) evolved into Client-Side Rendering (React/Angular consuming JSON APIs).
• Manual Tomcat Deployment evolved into embedded servers packaged as executable JARs (Spring Boot) or Docker containers.

Understanding these foundational technologies is critical because modern frameworks are simply automated wrappers around them.