Datatables Standalone Editor in Java Servlet

Question

I use the DataTables Standalone Editor for fields in my web application. The creators of this software have PHP classes but not java ones so I whipped up a quick java servlet to accept incoming fields to be edited. The javascript is as follows: (as you can see there are different fields for one url)

editor = new $.fn.dataTable.Editor( {
    ajax: "/json/fields/server",
    fields: [ {
            label: "Status:",
            name:  "status",
            type:  'radio',
            options: [
                { label: 'Enabled',  value: 'Enabled' },
                { label: 'Disabled', value: 'Disabled' }
            ]
        }, {
            label: "Server IP address:",
            name:  "server-ip"
        }, {
            label:     "Polling period:",
            name:      "poll-period"
        }, {
            name: "protocol", // `label` since `data-editor-label` is defined for this field
            type: "select",
            options: [
                { label: 'TCP', value: 'TCP' },
                { label: 'UDP', value: 'UDP' }
            ]
        }
    ]
} );

I use something like this in my java servlet:

String serverid = request.getParameter("serverid");
String[] status = {"status", request.getParameter("data[keyless][status]")};
String[] server-ip = {"server-ip", request.getParameter("data[keyless][server-ip]")};
String[] protocol = {"protocol", request.getParameter("data[keyless][protocol]")};

    String[][] fields = {status, server-ip, protocol};

    Connection conn = null;
    PreparedStatement pst = null;
    String write = null;
    try {
        conn = ConnectionManager.getConnection();
        for(String[] field : fields){
            if(field[1] != null){
                write = "{\"data\":[{\"" + field[0] + "\":\"" + field[1] + "\"}]}";

                pst = conn.prepareStatement("UPDATE server SET " + field[0] + " = ? WHERE id = ?");
                pst.setString(1, field[1]);
                pst.setString(2, serverid);
                pst.execute();
                pst.close();

                break;
            }
        }
    } catch (SQLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } finally {
        DBUtil.close(conn);
        DBUtil.close(pst);
    }

    response.setContentType("application/json");
    PrintWriter writer = response.getWriter();
    if(write != null)
        writer.write(write);
    writer.close();

I use the string array with the field name first to protect against sql injection attacks but I cant use parameters because the field name is dynamic.

My question is, is there a better way to accomplish this?

Answer 1

Yes. No need to reinvent the wheel. You can probably save yourself a lot of time by simply visiting http://jed-datatables.net . It has all the examples you'd would need to work with datatables.