Grails控制器-链接以从.gsp文件中选择元素

Question

So, I'm working on this grails application to create a web dashboard. So far, I have created a controller that queries metrics from my database and renders it as a JSON file, which I feed to d3 and other javascript libraries on the front end gsp file.

My question is this: I have a certain drop down menu on my front end as follows:

<select onchange="loadData()" id="metric" class="dropdown">
    <option value ="sales">Sales</option>
    <option value ="visits">Visits</option>
</select>

And my corresponding controller, in its simplest form, has the following actions: (Importing grails.converters and groovy.sql.sql)

def dataSource
def listJson = {
    def sql = new Sql(dataSource)
    def rows = sql.rows("select date_hour, total_revenue as sales, visits from table")
    sql.close()
    render rows as JSON
}

The problem now is, I have a bunch of drop down menus, and quite a lot of options in each, for each of which, if I did as above, I would have to create a new json file for d3 to use. Instead, can't I somehow insert the value of the option from the select element above, into the sql statement in the controller?

Something like the one below, but I don't know if it's possible, and if it is, the right syntax. I'm using grails 2.3.4 right now.

def listJson = {
    def sql = new Sql(dataSource)
    def rows = sql.rows("select date_hour, total_revenue as sales, ${index #metric} from table")
    sql.close()
    render rows as JSON
}

where index is my index.gsp file (where the select option is), and #metric, the id of the element.

Thanks in advance!

Answer 1

You can get the value of the select from params in your controller. For example:

def listJson = {
    def metric = params.metric
    // build query...
    def query = "... ${metric} ..."
}

However, I'd advise against building a SQL query like this. Any time you accept user input as part of a SQL query it provides a huge opportunity for SQL injection attacks. Why not use a higher level database abstraction like GORM? Also note that groovy uses different parameter expansion in SQL queries than regular strings to generate for PreparedStatements. You'd need to write your example like this: sql.rows("select date_hour, total_revenue as sales, " + metric + " from table")

Finally, while it depends on how you're submitting the request in loadData() , the usual convention for HTML input elements is to submit the value with the element name attribute as the key, not the id .