Best Practices – JDBC

Continuing from the previous entry, I’ll discuss JDBC. Although there was a section on Servlets, the recommendations are more decision-levels such as deciding on a framework, mad caching and hiring a UI designer. So here I go…

Use DataSource Whenever Possible

I don’t fully agree with this yet, since I still don’t see the absolute benefit when using the DataSource technique. The book explains that using the old Class.forName() and DriverManager.getConnection() contains references to specific implementation classes.

I don’t agree because these information are Strings, which can be read from a config file and drivers can be loaded dynamically. Java programmers have always also used generic JDBC interface to deal with the underlying database (as I mentioned in a previous post).Therefore I see the same level of portability in using both methods, especially when a ConnectionManager is used to retrieve connections (encapsulation of connection logic).

Pool Database Connections

Enough said. If you don’t understand this ask me or Google.

Separate Application, Persistence and JDBC logic.

As per most apps, beans are used to model entity information and are already separate from JDBC logic. As a plus, using a DAO interface model can further isolate your persistence logic from the application, allowing your underlying persistence implementation to switch to non-JDBC.

This is already a common pattern in EJB, where entity beans rely on a DAO to perform stores, loads and finds.

Do not Rely on Built-in Key Generation

For portability sake, this is a must. Besides difficulty in locating the record just inserted, other databases might not have this feature.

The book also provide a sequencing method to generate unique keys, though I think it can be more easily implemented with a SELECT MAX (only for trivial apps) or a separate table storing the current sequence. The method presented offers better performance than my methods, so do an evaluation before deciding which to use.

Use PreparedStatement

I would say not only use it, but use it correctly. The purpose of using PREPARED statements is that it can be executed repeatedly efficiently. Therefore if you prepare a statement, execute it once, and prepare the same statement again next time and execute it once, you aren’t really using PreparedStatement correctly.

The preferred way to use PreparedStatements is have it prepared once, and executed many times. Be it a static query or with ? parameters, these “prepared” statements will offer better performance.

Reference Columns By Number

This is actually two problems in one. The first is that access to metadata information is expensive, and referencing column by name requires metadata. Most programmers access columns by name now due to the flexibility and convenience of not needing to remember column numbers as well as able to change the sequence in the SELECT without affecting the code.

However, just like column numbers can change, column names can change as well when the SQL is changed. The book says that rs.getLong(1) is as bad as rs.getLong("personID")

The “correct” solution is to externalize both the SQL and the sequence number so that the query can be changed without affecting the code

new PreparedStatement(PERSON_QUERY);
rs.getLong(PERSON_QUERY_PERSON_ID);

Close Statements and ResultSets

Despit JDBC specifications, some drivers do not clean up as cleanly as specified. To clean up completely, use the finally clause. In fact, this template should always be used.

Connection conn = null;
PreparedStatement stmt = null;
ResultSet rs = null;
try {
conn = ..;
stmt = conn.prepareStatement(..);
stmt.set..(..);
rs = stmt.executeQuery();
while (rs.next())
// ..
} catch (SQLException sqlE) {
// handle exception
} finally {
if (rs != null)
try { rs.close() } catch (SQLException sqlE) {}
if (stmt != null)
try { stmt.close() } catch (SQLException sqlE) {}
if (conn != null)
try { conn.close() } catch (SQLException sqlE) {}
}

Thread JDBC code in Swing Applications

In general I think this should be “Thread time-consuming task in GUI applications”. The threading, though it complicates the code, is necessary to provide a responsive GUI to the user. When time consuming tasks are performed in the GUI event thread, the event thread is unable to perform other tasks such as redrawing the UI or getting input from the user through the UI. This includes unable to cancel the event if the user chooses to.

At the same time, care should be taken when accessing GUI elements from threads. See the wiki for more information on this.

Do Not Use Primary Keys with Real-World Meaning

This tip effectively contradicts with the perfect data model of the primary key. The fact it is listed as a best practice in a published book demonstrates the vast difference between academic theory and industry practice. However for practical purposes, it is still better to issue a meaningless identifier to the data row.

You might argue some data like your IC number don’t change, but they might be entered incorrectly into the system in the first place (data entry, human/machine error) and needs to be modified.

Java Enterprise Best Practices – EJB

This book from O’Reilly provides “Expert Tips & Tricks for Java Enterprise Programmers”. Apart from pure EJB stuff, the book covers tips for servlets, JDBC, XML, etc. I’ll be wrapping up the tips in a few short notes, espcially those I’ve seen/read around. First I discuss EJB tips.

Use ValueObjects for bulk data transfer.

Instead of making a get call for each property in your remote object, use a session bean to grab all necessary properties in a single call (thus also using the session facade)

Handle Exception in EJB Code Correctly.

My opinion about this is you should handle exceptions correctly EVERYWHERE! This involves understanding of when to throw, catch or wrap an exception. For EJB the logic is:

RemoteException: declared on all remote interfaces exposed by EJB. Used to indicate a network problem. You should not throw it yourself. If you call another remote object and receive a remote exception, wrap it in an EJBException.

EJBException: Thrown by developer and caught by container. Indicates major error to signal container to perform a transactional rollback. Like a NullPointerException, it’s a runtime exception and should not be caught by a developer. A common use is wrapping SQLExceptions into EJBException.

Application-level Exception: Should be thrown/caught by developer as part of application logic. Must be serializable (the exception will travel across the network). Do remember Exception Basics: Don’t use exceptions to indicate normal flow.

Using Business Delegates for Clients

This may look like pure redundancy to new-to-EJB programmers, however this cleanly separates client logic and EJB logic. One way to see this problem is when importing EJB packages in servlet classes. If the back end changes to non-EJB or the front end changes to non-webbased you get a problem. By introducing another layer into the already-many-layers you improve scalability and maintainability of your application (theoratically).

Create a Build Environment.

Even if you have a fantastic IDE that can automatically do all these for you, it’s useful to be able to make small changes to your app and re-building it without firing up and twiddling with the (likely-heavy) IDE. This is even more useful if you really understand your deployment. (and useful for people to learn about the actual deployment)

Displaytag taglib

The displaytag library is a useful JSP taglib for generating html tables containing data in lists. By putting JavaBeans in an iterable list, the tag library can format the list into a HTML table, complete with the following features:

  • Mapping columns to bean properties
  • Built-in Pagination
  • Built-in Sorting
  • External sorting/pagination
  • I18n
  • Styles
  • Exporting to PDF/Excel
  • Integration with struts
  • Grouping (never tried)
  • Integration with webwork, sping framework (never tried)

Rating 4 out of 5. Excellent features, easy to use. 1 missing for un-organized documentation.

http://displaytag.sourceforge.net/11/

Apache Jakarta Struts (Action 1)

For the past two weeks I have actually been looking at a lot of Struts, but i’m still not well-versed enough to document it down, also because of the amount of information needed to document it. Seems like it’ll take a few pages.

Briefly going through it, Struts is a web application framework that enforces the MVC model. The sequence generally goes like this:

  1. The user makes a HTTP request through the web (e.g. Employee.do?method=retrieve&empId=23)
  2. The web server receives the request. By servlet mapping in web.xml, *.do requests are handled by the struts ActionServlet. The HTTP request is passed to the ActionServlet, which works as a controller dispatcher.
  3. The ActionServlet receives the request, and checks the name of the .do (Employee). It looks up the action mapping configured in struts-config.xml (or a corresponding module config file). Information regarding the action’s form bean, Action class, validation, mapping forwards are retrieved.
  4. The form bean declares the request parameters as Java data types, allowing automatic mapping to be performed, instead of retrieving all parameters as Strings.
  5. If validation is required, validation is performed based on the form bean types, and any validation.xml as configured in the Validator plug-in. The configuration file allows basic checking such as required fields, less-than/more-than, regex, as well as custom validation providers. If validation fails, the request is immediately forwarded to the validation failure page.
  6. Once validation passes, the Form Bean class is created and populated with the corresponding values in the request. The Action class is then called to perform business logic, using the information in the form bean class. The Action then redirects to the appropriate mapping forwards as defined in the action configuration.
  7. Control returns to the ActionServlet, which looks up the actual URL of the mapping forward in the config file. All these lookups allow complete separation of URLs between the view and model.
  8. The actual URL content is served to the client.

The framework is highly configurable, such as splitting the configuration into modules, using dynamic forms without creating actual form beans, tag libraries that easily display and retain information in form beans, etc.

Apart from Action 1, Struts also evolved into Action 2 and Shale Frameworks, which I’m unsure of the differences.

ClassCastException on RemotePortableObject.narrow

Been working on EJB with JBoss and Eclipse. I must say the XDoclet (with Ant) was a greate help in generating beans and doing packaging. Despite great tools, I met with a major error that had me stumped for 4 hours.

InitialContext ic = new InitialContext();
Object obj = ic.lookup("...");
SomeHome home = (SomeHome)PortablRemoteObject.narrow(obj, SomeHome.class);

A simple lookup like this, with a ClassCastException on the 3rd line. A class cast means the lookup was successful, someHomeObj is not null, but is not of type SomeHome (which happens to be an interface).

It usually means you’re casting to the wrong type, probably a typo or type confusion. But for my case I checked and rechecked and it was no error. No matter what I did couldn’t make the exception go away. This includes reflecting on the class, superclass and the interfaces of the object, to convince myself the types were correct.

// prints $Proxy157
sop(obj.getClass());

// prints java.lang.reflect.Proxy
sop(obj.getClass().getSuperClass());

// prints SomeHome, Handle
for (Class c : obj.getClass().getInterfaces())
    sop(c);

!!! The class actually implements SomeHome!!! But fails the narrow!!! *fumes* I even tested each line inside the narrow() implementation, and despite having implemented SomeHome, it cannot be cast into or assigned as SomeHome. (instanceof SomeHome == false, isAssignableFrom(SomeHome.class) == false, instanceof org.omg.CORBA.Object == false)

After hours of twiddling I finally found out it was because there were TWO of this interfaces being deployed, one in my ejb .jar, the other in my .war classes. The lookup returned the interface from the ejbjar, and was trying to cast it into the war interface. Therefore even though they had the same interface name (from the same package), they were 2 different classes.

To fix this i adjusted my package build, to EXCLUDE the interface classes from my war. A simple rebuild and the narrow works.

Sun Java goes Open Source!

After 2 years of pressure from the open-source community, Sun has finally decided to open-source Java. Sun was previously worried about compatibility and forking, since people could make their own versions or move towards other goals, making Java lose focus. The prime example was Linux. Some say Sun was afraid of losing control of Java. Whether they are really convinced now that open source is the way to go, or to pull up their stagnant stock prices…

In one of the issues in 2004, the president of the Open Source Initiative (OSI) dropped an open letter to then Sun CEO Scott McNealy touting that Sun is just using open-source as marketing but not really supporting it [1]. He compared Java and Sun to Tiger Woods and his dad, who supported his child by recognizing and letting him achieve his full potential from an early age. He says Sun is restricting Java’s potential, and it would not help even if Sun releases it later, as Woods would not have done it too if he started only later.

The saga went on with Sun spokesman replying to the media (but not to the sender) rebutting each of his points in exact quotes, and OSI president writing a second open letter in response…

Sun have announced that they’re doing it for sure, but its CEO is seeking advice on HOW it should be done.

[1] http://www.catb.org/~esr/writings/let-java-go.html
[2] http://news.zdnet.com/2100-9593_22-6072760.html
[3] http://www.vnunet.com/vnunet/news/21562 … ource-java
[4] http://www.iht.com/articles/2006/05/17/business/sun.php

Get Real! No Perfect Code

No commercial system is perfect – I added “commercial” because you could technically create a one-liner program that prints text to the screen. It matches your specifications exactly to print a line of text, thus perfect code.

Commercial systems, one that you can really sell and earn bucks, are far less than perfect. Bugs occur due to individuals – pure carelessness, lack of skill, too much code to handle for a single programmer; due to team – poor design, poor management, poor leadership, wrong use of tools, technology, architecture, design; due to customers – poor requirements, miscommunication, scope creep; plus so many other reasons for any bug.

Level 1 people still expect bugless code: clients who do not accept products with known bugs, or developers who try to fix every known bug to try achieve the bugless state. Level 2 developers understand this imperfection, but anyhow choose bugs to fix: the most common mistake is fixing bugs that are “easy to fix”. However, that bug may not have a big impact or severity, instead increases chances of introducing new bugs (as described below). High-level people like Eric uses a process to determine which bugs are worth fixing.

Eric approaches bugs in a well-defined process: After a bug is reported and confirmed, a decision must be made to FIX or NOT FIX the bug. This is because:

  1. There is a time constraint to fix all bugs
  2. Fixing a bug may introduce more bugs

The bug is analysed in terms of Severity, Frequency, Cost, Risk. The first 2 relate to the client: what the impact is and how often is occurs. The last 2 relates to the developers: how difficult / how long to fix it and the probability of introducing more bugs.

The recommendation is to plot the first 2 factors on a graph. Always fix stuff in the top right corner and never fix stuff in the bottom left. The factor ratings might change over time, such as a miscalculated risk. Re-visiting these factors when they change can allow us to make better decisions (including rollback bugfixes).

[1] is a condensed version of what Eric wrote in [2] originally.

[1] http://technology.guardian.co.uk/weekly … 95,00.html
[2] http://software.ericsink.com/articles/F … tions.html

RFID = vulnerable

RFID, short for radio frequency identification, is becoming the de facto identification mechanism recently. There is no need for line-of-sight, can be embedded as passive emitters (no onboard battery), and can be small enough to be implanted into the human skin.

However, like the early Internet stages, security was not a concern and was not considered in its design. This leads to problems especially when many RFID are used in security areas such as building passes and passports. Other uses include tracking shipment, retail stores, library books. The tags may store credit information, which can be used in gaming centers, public transport, petrol stations and toll gates.

Data on an RFID can be easily tapped by a scanner. They are usually unencrypted AND unlocked, meaning they can be read in clear and even overwritten. People have tried tapping a hotel keycard and transferring the information onto a cream cheese (retail food product) with an RFID tag. He then used the cheese to open his hotel door!

Building passes can also be scanned by just walking past the person who keeps the pass in his wallet or bag. The signal can be re-emitted at the building door to gain access easily. Walking along a shelf of library books using an emitter can potentially erase all information in those tags if they are left unlocked. Free gas top-ups are possible and are tried and tested.

I wonder if our EZLink, ERP, NLB, and building passes in Singapore have the same security issues…

http://www.wired.com/wired/archive/14.05/rfid.html

VS2005 – First Chance Exceptions

When running CF apps in debug mode using VS2005, I could always see messages like:

A first chance exception of type "System.FileNotFoundException" occured in mscorlib.dll

Why are the core libraries throwing exceptions and how to avoid them? It turns out that first chance exceptions occur whenever exceptions are thrown (duh). If they are caught (with a try/catch clause) the application continues to run normally, but the debugger will print that line into the output. If the exception is uncaught, the debugger is notified again and the application breaks into debug mode. This is known as “second chance exception”. So far from what I see, it means you cannot avoid getting the first chance exceptions.

According to the links below, VS can be configured to react differently at the chance exceptions. Different actions may be taken for different exceptions or exception groups (exceptions hierarchy).

http://blogs.msdn.com/davidklinems/arch … 38061.aspx
http://www.codeproject.com/useritems/Un … ptions.asp