# data[].attributes.attachment_link.description
GitHub is home to all kinds of software projects, from simple programs to today's most popular apps. Hello, worldSay "hello" to a com...

# data[].attributes.body
Unfortunately I was not satisfied  with the seminar about multilingualism in India by Neida Inamdar. Learning about an India project as a response to bilingual models in India school education sounds interesting but I found it quite boring to listen to a long series of detailed information about the enormous number of Indian dialects and languages stated by a big number of linguistic surveys.

I coudn't see  any challenge or opportunities to enrich my CLIL learning path  (apart from getting information about India).

As I am an  Information Techology teacher I didn't find the webinar about Storytelling (M. Constantinides) of great interest to me.

I think I will never use the digital tools suggested by the author but  they can be very useful for primary or lower secondary school teachers dealing with language.

# data[].attributes.body
t was very interesting to listen to David Marsh,  the greatest Clil expert,  who gave us the opportunity to see what's happening globally and to understand how CLIL can be realised through transversals across the curriculum.

I was also enthusiastic about PatricK de Boer  webinar who, after analysing the biggest CLIL challenges we have to face now, focused on a set of ready to use activities that can be implemented in any subject. Those activities are a useful instrument to help generate output and encourage active learning.

# data[].attributes.body
Learning designer is a useful tool to help you plan your teaching. It does this by asking you to think about the learning experiences you are planning for your students to meet their needs. It is also useful to share ideas among teachers.

# data[].attributes.attachment_link.title
This is part of our CLIL experience as a team teaching work involving me

# data[].attributes.body
https://youtu.be/YpvF7I5b_Vg

# data[].attributes.headline
Explain briefly what you have learnt from TECHNO-CLIL

# data[].attributes.subject
Explain briefly what you have learnt from TECHNO-CLIL

# data[].attributes.body
I learned from TECHNO-CLIL how a particular pedagogic approach can be migrated successfully across different topics with the Learning Designer suite of tools.

# data[].attributes.body
My students of the fifth year of the course of Computer Science have successfully used the course "Intro to SQL: Querying and managing data" of https://www.khanacademy.org/computing/computer-programming/sql
presented in the fifth week.

# data[].attributes.body
The Training course for teachers "Techno-CLIL 2017" is a completely free online training course, sponsored by a community of international practices, EVO, Electronic Village Online.
"Techno-CLIL" aims to combine CLIL with learning technologies, offering a number of practical ideas on instructional design CLIL mediated through the use of the network and webtool. The course is characterized by activities asynchronously and synchronously webinar on Moodle platform with international experts on Wiziq platform.

# data[].attributes.body
https://sites.google.com/site/workshopctandsblresourcesite/computational-thinking-rubric

# data[].attributes.headline
Planning a project based on CLIL Connections from a Graded Reader

# data[].attributes.subject
Planning a project based on CLIL Connections from a Graded Reader

# data[].attributes.attachment_link.title
WEEK 4 Extensive Reading and CLIL connections_Michele_Ioffredo

# data[].attributes.headline
OUTLINE OF THE LESSON PLAN (from Learning Designer)

# data[].attributes.subject
OUTLINE OF THE LESSON PLAN (from Learning Designer)

# data[].attributes.body
http://learningdesigner.org/viewer.php?uri=/shared/fid/52dc35600c0d19f7175a32ddc1c476b2be073d19c64e69491f7e05e86d3b63cc

# data[].attributes.headline
Potential Open Source technologies for CLIL using www.edmodo.com and github.com

# data[].attributes.subject
Potential Open Source technologies for CLIL using www.edmodo.com and github.com

# data[].attributes.body
The post describes some learning and collaborative activities, some tools and an on-line environment created to teach the Databases to secondary technical school students (aged 17-18). The on-line course, created by using the social learning www.edmodo.com, is a blended learning environment to support daily classroom activities. The on-line environment increases dynamically with the contribution of teacher and students and “wraps around” the class during the learning process. The course allows "Flipped Classroom" and collaborative activity (on-line and classroom), it supports discussion and sharing information. It also enables students to have personal/sharing areas for files and supports the main cloud services to upload/download files. It also enables students to use www.github.com  to create a personal project, whether you want to experiment with a Java programming language or host your life’s work. Topics of the course: modelling a database using the relational model, designing Entity/Relationship diagrams, SQL language, case studies based on real life and student scenarios.

# data[].attributes.headline
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 4: Output

# data[].attributes.subject
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 4: Output

# data[].attributes.attachment_link.description
ComputationalThinkingLab5B - Project E-CLIL School Job Alternation of experimentation in the Informatics laboraty class 5B

# data[].attributes.headline
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 3: Tasks

# data[].attributes.subject
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 3: Tasks

# data[].attributes.body
Use PreparedStatement to implement a Java class GetUserDetailsUsingPS and GetUserDetailsUsingPSTest.

# data[].attributes.headline
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 2: Input

# data[].attributes.subject
Team Teaching English  Informatics.  Learning units CLIL - 1 Level 2: Input

# data[].attributes.body
Brainstorming o KWL with Interactive Whiteboard.

# data[].attributes.attachment_link.readable_text
Today we will look into JDBC Statement vs PreparedStatement and some SQL Injection Example. While working with JDBC for database connectivity, we can use Statement or PreparedStatement to execute queries. These queries can be CRUD operation queries or even DDL queries to create or drop tables.

Statement vs PreparedStatement

Before comparing Statement vs PreparedStatement, let's see why we should avoid JDBC Statement. JDBC Statement has some major issues and should be avoided in all cases, let's see this with a simple example.

I have Users table in my local MySQL database with following data.

Below script will create the table and insert the data for test use.

CREATE TABLE `Users` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `name` varchar(20) NOT NULL DEFAULT '',
  `email` varchar(20) NOT NULL DEFAULT '',
  `country` varchar(20) DEFAULT 'USA',
  `password` varchar(20) NOT NULL DEFAULT '',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8;

INSERT INTO `Users` (`id`, `name`, `email`, `country`, `password`)
VALUES
	(1, 'Pankaj', 'pankaj@apple.com', 'India', 'pankaj123'),
	(4, 'David', 'david@gmail.com', 'USA', 'david123'),
	(5, 'Raman', 'raman@google.com', 'UK', 'raman123');

A utility class for creating JDBC Connection to our mysql database.
DBConnection.java

package com.journaldev.jdbc.statements;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.SQLException;

public class DBConnection {

	public final static String DB_DRIVER_CLASS = "com.mysql.jdbc.Driver";
	public final static String DB_URL = "jdbc:mysql://localhost:3306/UserDB";
	public final static String DB_USERNAME = "pankaj";
	public final static String DB_PASSWORD = "pankaj123";

	public static Connection getConnection() throws ClassNotFoundException, SQLException {

		Connection con = null;

		// load the Driver Class
		Class.forName(DB_DRIVER_CLASS);

		// create the connection now
		con = DriverManager.getConnection(DB_URL, DB_USERNAME, DB_PASSWORD);

		System.out.println("DB Connection created successfully");
		return con;
	}
}

Now let's say we have following class that asks user to enter the email id and password and if it matches, then prints the user details. I am using JDBC Statement for executing the query.
GetUserDetails.java

package com.journaldev.jdbc.statements;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Scanner;

public class GetUserDetails {

	public static void main(String[] args) throws ClassNotFoundException, SQLException {

		//read user entered data
		Scanner scanner = new Scanner(System.in);
		System.out.println("Please enter email id:");
		String id = scanner.nextLine();
		System.out.println("User id="+id);
		System.out.println("Please enter password to get details:");
		String pwd = scanner.nextLine();
		System.out.println("User password="+pwd);
		printUserData(id,pwd);

	}

	private static void printUserData(String id, String pwd) throws ClassNotFoundException, SQLException {

		Connection con = null;
		Statement stmt = null;
		ResultSet rs = null;
		try{
		con = DBConnection.getConnection();
		stmt = con.createStatement();
		String query = "select name, country, password from Users where email = '"+id+"' and password='"+pwd+"'";
		System.out.println(query);
		rs = stmt.executeQuery(query);

		while(rs.next()){
			System.out.println("Name="+rs.getString("name")+",country="+rs.getString("country")+",password="+rs.getString("password"));
		}
		}finally{
			if(rs != null) rs.close();
			stmt.close();
			con.close();
		}

	}

}

Let's see what happens when we pass different kinds of input to above program.

Valid User:

Please enter email id:
david@gmail.com
User id=david@gmail.com
Please enter password to get details:
david123
User password=david123
DB Connection created successfully
select name, country, password from Users where email = 'david@gmail.com' and password='david123'
Name=David,country=USA,password=david123

So our program works fine and a valid user can enter their credentials and get his details.

Now let's see how a hacker can get unauthorized access to a user because we are using Statement for executing queries.

SQL Injection:

Please enter email id:
david@gmail.com' or '1'='1
User id=david@gmail.com' or '1'='1
Please enter password to get details:

User password=
DB Connection created successfully
select name, country, password from Users where email = 'david@gmail.com' or '1'='1' and password=''
Name=David,country=USA,password=david123

As you can see that we are able to get the user details even without having password. The key point to note here is that query is created through String concatenation and if we provide proper input, we can hack the system, like here we did by passing user id as david@gmail.com' or '1'='1.

This is an example of SQL Injection where poor programming is responsible for making our application vulnerable for unauthorized database access.

One solution is to read the user input and then escape all the special characters that are used by MySQL but that would be clumsy and error prone. That's why JDBC API came up with PreparedStatement interface that extends Statement and automatically escape the special characters before executing the query.

Let's rewrite above class using PreparedStatement and try to hack the system.
GetUserDetailsUsingPS.java

package com.journaldev.jdbc.statements;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Scanner;

public class GetUserDetailsUsingPS {

	public static void main(String[] args) throws ClassNotFoundException, SQLException {

		// read user entered data
		Scanner scanner = new Scanner(System.in);
		System.out.println("Please enter email id:");
		String id = scanner.nextLine();
		System.out.println("User id=" + id);
		System.out.println("Please enter password to get details:");
		String pwd = scanner.nextLine();
		System.out.println("User password=" + pwd);
		printUserData(id, pwd);
	}

	private static void printUserData(String id, String pwd) throws ClassNotFoundException,
			SQLException {

		Connection con = null;
		PreparedStatement ps = null;
		ResultSet rs = null;
		String query = "select name, country, password from Users where email = ? and password = ?";
		try {
			con = DBConnection.getConnection();
			ps = con.prepareStatement(query);

			//set the parameter
			ps.setString(1, id);
			ps.setString(2, pwd);
			rs = ps.executeQuery();

			while (rs.next()) {
				System.out.println("Name=" + rs.getString("name") + ",country="
						+ rs.getString("country") + ",password="
						+ rs.getString("password"));
			}
		} finally {
			if (rs != null)
				rs.close();
			ps.close();
			con.close();
		}

	}
}

Now if we will try to hack the system, let's see what happens.

SQL Injection:

Please enter email id:
david@gmail.com' or '1'='1
User id=david@gmail.com' or '1'='1
Please enter password to get details:

User password=
DB Connection created successfully

So we are not able to hack the database, it happened because the actual query that is getting executed is:
select name, country, password from Users where email = 'david@gmail.com\' or \'1\'=\'1\' and password=''
When we fire a query to be executed for a relational database, it goes through following steps.

1. Parsing of SQL query

2. Compilation of SQL Query

3. Planning and optimization of data acquisition path

4. Executing the optimized query and return the resulted data

When we use Statement, it goes through all the four steps but with PreparedStatement first three steps are executed when we create the prepared statement. So execution of query takes less time and more quick that Statement.

Another benefit of using PreparedStatement is that we can use Batch Processing through addBatch() and executeBatch() methods. We can create a single prepared statement and use it to execute multiple queries.

Some points to remember about JDBC PreparedStatement are:

1. PreparedStatement helps us in preventing SQL injection attacks because it automatically escapes the special characters.

2. PreparedStatement allows us to execute dynamic queries with parameter inputs.

3. PreparedStatement provides different types of setter methods to set the input parameters for the query.

4. PreparedStatement is faster than Statement. It becomes more visible when we reuse the PreparedStatement or use it's batch processing methods for executing multiple queries.

5. PreparedStatement helps us in writing object Oriented code with setter methods whereas with Statement we have to use String Concatenation to create the query. If there are multiple parameters to set, writing Query using String concatenation looks very ugly and error prone.

6. PreparedStatement returns FORWARD_ONLY ResultSet, so we can only move in forward direction.

7. Unlike Java Arrays or List, the indexing of PreparedStatement variables starts with 1.

8. One of the limitation of PreparedStatement is that we can't use it for SQL queries with IN clause because PreparedStatement doesn't allow us to bind multiple values for single placeholder (?). However there are few alternative approaches to use PreparedStatement for IN clause, read more at JDBC PreparedStatement IN clause.

That's all for the comparison of JDBC Statement vs PreparedStatement. You should always use PreparedStatement because it's fast, object oriented, dynamic and more reliable.

# data[].attributes.attachment_link.title
JDBC Statement vs PreparedStatement - SQL Injection Example - JournalDev

# data[].attributes.attachment_link.description
Today we will look into JDBC Statement vs PreparedStatement and some SQL Injection Example. While working with JDBC for database connectivity, we can use Statement or PreparedStatement to execute queries. These queries can be CRUD operation queries or even DDL queries to create or drop tables.

# data[].attributes.headline
Team Teaching English  Informatics. Learning units CLIL - 1 Level 1: Select

# data[].attributes.subject
Team Teaching English  Informatics. Learning units CLIL - 1 Level 1: Select

# data[].attributes.body
1. Relational databases and SQL language
1.1 Access to a database in Java with JDBC
1.1.1  Connection to a DBMS and processing of commands and SQL queries in Java
1.1.1.1 JDBC Statement vs PreparedStatement – SQL Injection Example

# data[].attributes.body
My name is Michele Ioffredo and I work as a teacher in a Techical Institute in Naples, Italy. I am an expert in Computational Thinking in Java and I love to integrate it in my teaching as well as esperimenting new methods. I also love to involve my students in projects concerning databases, Model View Control framework or web services.
https://www.zeemaps.com/edit/cv0zId_xkFEVXQcdy_FeRURj96MCICZM

https://padlet.com/michele_ioffredo_dv/tqf867vqofde
https://www.zeemaps.com/edit/cv0zId_xkFGEhheZaL0-kXdmCeY1hqLu

# data[].attributes.attachment_link.description
Sito professionale del Prof. Michele Ioffredo