12

I have a table which has a data column with an structure similar to following:

{"title": "some title", "objects": [{"id": "id1"}, {"id": "id2"}]}

now I want to find all rows that have an object with specific id in their objects array inside data. Following query works perfectly from PSQL console:

SELECT id, data FROM table_name WHERE data->'objects' @> '[{"id": "id1"}]'

however I can not get this to work as a prepared statement over JDBC driver. the value for id should be a parameter, so I tried this as the string that is passed to connection.prepareStatement(query);:

"SELECT id, data FROM table_name WHERE data->'objects' @> '[{\"id\": ?}]'"

here when I try to set arguments I get this exception:

org.postgresql.util.PSQLException: The column index is out of range: 1, number of columns: 0.

when I try any of the following the argument is set correctly:

"SELECT id, data FROM table_name WHERE data->'objects' @> [{\"id\": ?}]"
"SELECT id, data FROM table_name WHERE data->'objects' @> [{'id': ?}]"

but the result is obviously not a properly formatted query:

SELECT id, data FROM table_name WHERE data->'objects' @> [{"id": 'id1'}]
SELECT id, data FROM table_name WHERE data->'objects' @> [{'id': 'id1'}]

in both cases I get following exception:

org.postgresql.util.PSQLException: ERROR: syntax error at or near "["

What is the correct syntax to set a parameter inside JSON? I'm using PostgreSql 9.5

6
  • Strings in SQL are delimited by single quotes, not double quotes Commented May 24, 2016 at 20:08
  • try SELECT id, data FROM table_name WHERE data->'objects' @> ? where ? is [{"id": "id1"}] Commented May 24, 2016 at 20:10
  • not sure which ones you mean, but those skipped ones are Java strings passed to connection.prepareStatement
    – mohamnag
    Commented May 24, 2016 at 20:10
  • single question mark just fails as it is interpreted as placeholders without value, double quotation like WHERE data->'objects' @> '??' where ?? is [{\"id\": ?}] also fails with this: ERROR: syntax error at or near "where"
    – mohamnag
    Commented May 24, 2016 at 20:13
  • No, I think Leo means "data->'objects' @> ?" Commented May 24, 2016 at 20:44

1 Answer 1

12

I actually reached out to JDBC developers over at Github and after some discussions it seems that currently the best solution is to have the prepared statement as follows:

String query = "SELECT id, data FROM table_name WHERE data->'objects' @> ?::jsonb";

and pass the whole search criteria as stringified JSON object for the parameter:

PreparedStatement st = connection.prepareStatement(query);
st.setString(1, "[\"id\":" + "id1" + "]");
st.executeQuery();

thats not a perfect solution but seems the best possible due to lack of server capabilities. At the end its not so bad as there is (theoretically) no risk of SQL injection.

More details on the linked Github issue.

2
  • Thanks for sharing your conclusion. I ended up taking the same approach.
    – Dan Burton
    Commented Jun 2, 2016 at 1:03
  • no problem, this seems to be a pretty popular problem and the best solution is to have a wider set of selectors on server side. lets hope guys at postgres will hear us.
    – mohamnag
    Commented Jun 6, 2016 at 6:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.