oracle provider: use prepared statements with parameters (implements #16251)

jef-n · jef-n · commit fb409b59a9ab · 2017-03-03T00:08:14.000+01:00
diff --git a/src/providers/oracle/ocispatial/qsql_ocispatial.cpp b/src/providers/oracle/ocispatial/qsql_ocispatial.cpp
@@ -2920,20 +2920,20 @@ void QOCISpatialCols::getValues( QVector<QVariant> &v, int index )
 
 QOCISpatialResultPrivate::QOCISpatialResultPrivate( QOCISpatialResult *q, const QOCISpatialDriver *drv )
     : QSqlCachedResultPrivate( q, drv )
-    , cols( 0 )
+    , cols( nullptr )
     , env( drv_d_func()->env )
-    , err( 0 )
+    , err( nullptr )
     , svc( const_cast<OCISvcCtx*&>( drv_d_func()->svc ) )
-    , sql( 0 )
+    , sql( nullptr )
     , sdoobj()
     , sdoind()
     , transaction( drv_d_func()->transaction )
     , serverVersion( drv_d_func()->serverVersion )
     , prefetchRows( drv_d_func()->prefetchRows )
     , prefetchMem( drv_d_func()->prefetchMem )
     , geometryTDO( drv_d_func()->geometryTDO )
-    , geometryObj( 0 )
-    , geometryInd( 0 )
+    , geometryObj( nullptr )
+    , geometryInd( nullptr )
 {
   ENTER
   int r = OCIHandleAlloc( env,
@@ -2960,7 +2960,14 @@ QOCISpatialResultPrivate::~QOCISpatialResultPrivate()
 
   r = OCIHandleFree( err, OCI_HTYPE_ERROR );
   if ( r != OCI_SUCCESS )
-    qWarning( "~QOCISpatialResult: unable to free statement handle" );
+    qWarning( "~QOCISpatialResult: unable to free error handle" );
+
+  if ( sql )
+  {
+    r = OCIHandleFree( sql, OCI_HTYPE_STMT );
+    if ( r != OCI_SUCCESS )
+      qWarning( "~QOCISpatialResult: unable to free statement handle" );
+  }
 }
 
 
@@ -3009,6 +3016,7 @@ bool QOCISpatialResult::gotoNext( QSqlCachedResult::ValueCache &values, int inde
       break;
     case OCI_SUCCESS_WITH_INFO:
       qOraWarning( "QOCISpatialResult::gotoNext: SuccessWithInfo: ", d->err );
+      qDebug() << "QOCISpatialResult::gotoNext: statement " << lastQuery();
       r = OCI_SUCCESS; //ignore it
       break;
     case OCI_NO_DATA:
@@ -3114,6 +3122,7 @@ bool QOCISpatialResult::prepare( const QString& query )
     r = OCIHandleFree( d->sql, OCI_HTYPE_STMT );
     if ( r != OCI_SUCCESS )
       qOraWarning( "QOCISpatialResult::prepare: unable to free statement handle:", d->err );
+    d->sql = nullptr;
   }
   if ( query.isEmpty() )
     return false;
diff --git a/src/providers/oracle/qgsoracleconn.cpp b/src/providers/oracle/qgsoracleconn.cpp
@@ -123,7 +123,7 @@ QgsOracleConn::QgsOracleConn( QgsDataSourceUri uri )
   {
     QSqlQuery qry( mDatabase );
 
-    if ( !qry.exec( QString( "BEGIN\nDBMS_WM.GotoWorkspace(%1);\nEND;" ).arg( quotedValue( workspace ) ) ) )
+    if ( !qry.prepare( QString( "BEGIN\nDBMS_WM.GotoWorkspace(?);\nEND;" ) ) || !( qry.addBindValue( workspace ), qry.exec() ) )
     {
       mDatabase.close();
       QgsMessageLog::logMessage( tr( "Could not switch to workspace %1 [%2]" ).arg( workspace, qry.lastError().databaseText() ), tr( "Oracle" ) );
@@ -172,11 +172,22 @@ void QgsOracleConn::disconnect()
   deleteLater();
 }
 
-bool QgsOracleConn::exec( QSqlQuery &qry, QString sql )
+bool QgsOracleConn::exec( QSqlQuery &qry, QString sql, const QVariantList &params )
 {
   QgsDebugMsgLevel( QString( "SQL: %1" ).arg( sql ), 4 );
 
-  bool res = qry.exec( sql );
+  bool res = qry.prepare( sql );
+  if ( res )
+  {
+  for ( const auto &param: params )
+    {
+      QgsDebugMsgLevel( QString( " ARG: %1 [%2]" ).arg( param.toString() ).arg( param.typeName() ), 4 );
+      qry.addBindValue( param );
+    }
+
+    res = qry.exec();
+  }
+
   if ( !res )
   {
     QgsDebugMsg( QString( "SQL: %1\nERROR: %2" )
@@ -192,10 +203,10 @@ QStringList QgsOracleConn::pkCandidates( QString ownerName, QString viewName )
   QStringList cols;
 
   QSqlQuery qry( mDatabase );
-  if ( !exec( qry, QString( "SELECT column_name FROM all_tab_columns WHERE owner=%1 AND table_name=%2 ORDER BY column_id" )
-              .arg( quotedValue( ownerName ) ).arg( quotedValue( viewName ) ) ) )
+  if ( !exec( qry, QString( "SELECT column_name FROM all_tab_columns WHERE owner=? AND table_name=? ORDER BY column_id" ),
+              QVariantList() << ownerName << viewName ) )
   {
-    QgsMessageLog::logMessage( tr( "SQL:%1\nerror:%2\n" ).arg( qry.lastQuery() ).arg( qry.lastError().text() ), tr( "Oracle" ) );
+    QgsMessageLog::logMessage( tr( "SQL:%1 [owner:%2 table_name:%3]\nerror:%4\n" ).arg( qry.lastQuery(), qry.lastError().text(), ownerName, viewName ), tr( "Oracle" ) );
     return cols;
   }
 
@@ -242,7 +253,7 @@ bool QgsOracleConn::tableInfo( bool geometryColumnsOnly, bool userTablesOnly, bo
   // sql += " ORDER BY owner,isview,table_name,column_name";
 
   QSqlQuery qry( mDatabase );
-  if ( !exec( qry, sql ) )
+  if ( !exec( qry, sql, QVariantList() ) )
   {
     QgsMessageLog::logMessage( tr( "Querying available tables failed.\nSQL:%1\nerror:%2\n" ).arg( qry.lastQuery() ).arg( qry.lastError().text() ), tr( "Oracle" ) );
     return false;
@@ -451,7 +462,7 @@ void QgsOracleConn::retrieveLayerTypes( QgsOracleLayerProperty &layerProperty, b
   if ( !exec( qry, sql
               .arg( quotedIdentifier( layerProperty.geometryColName ) )
               .arg( table )
-              .arg( where.isEmpty() ? "" : QString( " AND (%1)" ).arg( where ) ) ) )
+              .arg( where.isEmpty() ? "" : QString( " AND (%1)" ).arg( where ) ), QVariantList() ) )
   {
     QgsMessageLog::logMessage( tr( "SQL:%1\nerror:%2\n" )
                                .arg( qry.lastQuery() )
@@ -809,7 +820,7 @@ bool QgsOracleConn::hasSpatial()
   if ( mHasSpatial == -1 )
   {
     QSqlQuery qry( mDatabase );
-    mHasSpatial = exec( qry, "SELECT 1 FROM v$option WHERE parameter='Spatial' AND value='TRUE'" ) && qry.next();
+    mHasSpatial = exec( qry, "SELECT 1 FROM v$option WHERE parameter='Spatial' AND value='TRUE'", QVariantList() ) && qry.next();
   }
 
   return mHasSpatial;
@@ -820,7 +831,7 @@ QString QgsOracleConn::currentUser()
   if ( mCurrentUser.isNull() )
   {
     QSqlQuery qry( mDatabase );
-    if ( exec( qry, "SELECT user FROM dual" ) && qry.next() )
+    if ( exec( qry, "SELECT user FROM dual", QVariantList() ) && qry.next() )
     {
       mCurrentUser = qry.value( 0 ).toString();
     }
diff --git a/src/providers/oracle/qgsoracleconn.h b/src/providers/oracle/qgsoracleconn.h
@@ -24,6 +24,7 @@
 #include <QMap>
 #include <QSet>
 #include <QThread>
+#include <QVariant>
 
 #include "qgis.h"
 #include "qgsdatasourceuri.h"
@@ -172,7 +173,7 @@ class QgsOracleConn : public QObject
     explicit QgsOracleConn( QgsDataSourceUri uri );
     ~QgsOracleConn();
 
-    bool exec( QSqlQuery &qry, QString sql );
+    bool exec( QSqlQuery &qry, QString sql, const QVariantList &params );
 
     //! reference count
     int mRef;
diff --git a/src/providers/oracle/qgsoraclefeatureiterator.cpp b/src/providers/oracle/qgsoraclefeatureiterator.cpp
@@ -38,6 +38,7 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour
     return;
   }
 
+  QVariantList args;
   mQry = QSqlQuery( *mConnection );
 
   if ( mRequest.flags() & QgsFeatureRequest::SubsetOfAttributes )
@@ -79,17 +80,15 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour
       if ( mSource->mHasSpatialIndex )
       {
         QgsRectangle rect( mRequest.filterRect() );
-        QString bbox = QString( "mdsys.sdo_geometry(2003,%1,NULL,"
-                                "mdsys.sdo_elem_info_array(1,1003,3),"
-                                "mdsys.sdo_ordinate_array(%2,%3,%4,%5)"
-                                ")" )
-                       .arg( mSource->mSrid < 1 ? "NULL" : QString::number( mSource->mSrid ) )
-                       .arg( qgsDoubleToString( rect.xMinimum() ) )
-                       .arg( qgsDoubleToString( rect.yMinimum() ) )
-                       .arg( qgsDoubleToString( rect.xMaximum() ) )
-                       .arg( qgsDoubleToString( rect.yMaximum() ) );
-
-        whereClause = QString( "sdo_filter(%1,%2)='TRUE'" ).arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) ).arg( bbox );
+        QString bbox = QStringLiteral( "mdsys.sdo_geometry(2003,?,NULL,"
+                                       "mdsys.sdo_elem_info_array(1,1003,3),"
+                                       "mdsys.sdo_ordinate_array(?,?,?,?)"
+                                       ")" );
+
+        whereClause = QStringLiteral( "sdo_filter(%1,%2)='TRUE'" )
+                      .arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) ).arg( bbox );
+
+        args << ( mSource->mSrid < 1 ? QVariant( QVariant::Int ) : mSource->mSrid ) << rect.xMinimum() << rect.yMinimum() << rect.xMaximum() << rect.yMaximum();
 
         if (( mRequest.flags() & QgsFeatureRequest::ExactIntersect ) != 0 )
         {
@@ -99,6 +98,7 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour
             whereClause += QString( " AND sdo_relate(%1,%2,'mask=ANYINTERACT')='TRUE'" )
                            .arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) )
                            .arg( bbox );
+            args << ( mSource->mSrid < 1 ? QVariant( QVariant::Int ) : mSource->mSrid ) << rect.xMinimum() << rect.yMinimum() << rect.xMaximum() << rect.yMaximum();
           }
           else
           {
@@ -123,14 +123,14 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour
   {
     case QgsFeatureRequest::FilterFid:
     {
-      QString fidWhereClause = QgsOracleUtils::whereClause( mRequest.filterFid(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared );
+      QString fidWhereClause = QgsOracleUtils::whereClause( mRequest.filterFid(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared, args );
       whereClause = QgsOracleUtils::andWhereClauses( whereClause, fidWhereClause );
     }
     break;
 
     case QgsFeatureRequest::FilterFids:
     {
-      QString fidsWhereClause = QgsOracleUtils::whereClause( mRequest.filterFids(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared );
+      QString fidsWhereClause = QgsOracleUtils::whereClause( mRequest.filterFids(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared, args );
       whereClause = QgsOracleUtils::andWhereClauses( whereClause, fidsWhereClause );
     }
     break;
@@ -205,14 +205,15 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour
     if ( !whereClause.isEmpty() )
       whereClause += " AND ";
 
-    whereClause += QString( "rownum<=%1" ).arg( mRequest.limit() );
-    fallbackStatement += QString( "rownum<=%1" ).arg( mRequest.limit() );
+    whereClause += QStringLiteral( "rownum<=?" );
+    fallbackStatement += QStringLiteral( "rownum<=?" );
+    args << QVariant::fromValue( mRequest.limit() );
   }
 
-  bool result = openQuery( whereClause, !useFallback );
+  bool result = openQuery( whereClause, args, !useFallback );
   if ( !result && useFallback )
   {
-    result = openQuery( fallbackStatement );
+    result = openQuery( fallbackStatement, args );
     if ( result )
     {
       mExpressionCompiled = false;
@@ -249,7 +250,7 @@ bool QgsOracleFeatureIterator::fetchFeature( QgsFeature& feature )
     if ( mRewind )
     {
       mRewind = false;
-      if ( !QgsOracleProvider::exec( mQry, mSql ) )
+      if ( !QgsOracleProvider::exec( mQry, mSql, mArgs ) )
       {
         QgsMessageLog::logMessage( QObject::tr( "Fetching features failed.\nSQL:%1\nError: %2" )
                                    .arg( mQry.lastQuery() )
@@ -418,14 +419,14 @@ bool QgsOracleFeatureIterator::close()
 
   if ( mConnection )
     QgsOracleConnPool::instance()->releaseConnection( mConnection );
-  mConnection = 0;
+  mConnection = nullptr;
 
   iteratorClosed();
 
   return true;
 }
 
-bool QgsOracleFeatureIterator::openQuery( QString whereClause, bool showLog )
+bool QgsOracleFeatureIterator::openQuery( QString whereClause, QVariantList args, bool showLog )
 {
   try
   {
@@ -478,7 +479,8 @@ bool QgsOracleFeatureIterator::openQuery( QString whereClause, bool showLog )
 
     QgsDebugMsg( QString( "Fetch features: %1" ).arg( query ) );
     mSql = query;
-    if ( !QgsOracleProvider::exec( mQry, query ) )
+    mArgs = args;
+    if ( !QgsOracleProvider::exec( mQry, query, args ) )
     {
       if ( showLog )
       {
diff --git a/src/providers/oracle/qgsoraclefeatureiterator.h b/src/providers/oracle/qgsoraclefeatureiterator.h
@@ -70,7 +70,7 @@ class QgsOracleFeatureIterator : public QgsAbstractFeatureIteratorFromSource<Qgs
     virtual bool fetchFeature( QgsFeature& feature ) override;
     bool nextFeatureFilterExpression( QgsFeature& f ) override;
 
-    bool openQuery( QString whereClause, bool showLog = true );
+    bool openQuery( QString whereClause, QVariantList args, bool showLog = true );
 
     QgsOracleConn *mConnection = nullptr;
     QSqlQuery mQry;
@@ -79,6 +79,7 @@ class QgsOracleFeatureIterator : public QgsAbstractFeatureIteratorFromSource<Qgs
     bool mFetchGeometry;
     QgsAttributeList mAttributeList;
     QString mSql;
+    QVariantList mArgs;
 };
 
 #endif // QGSORACLEFEATUREITERATOR_H
diff --git a/src/providers/oracle/qgsoracleprovider.cpp b/src/providers/oracle/qgsoracleprovider.cpp
diff --git a/src/providers/oracle/qgsoracleprovider.h b/src/providers/oracle/qgsoracleprovider.h

Original file line number	Diff line number	Diff line change
`@@ -123,7 +123,7 @@ QgsOracleConn::QgsOracleConn( QgsDataSourceUri uri )`
`123`	`123`	`{`
`124`	`124`	`QSqlQuery qry( mDatabase );`
`125`	`125`
`126`		`- if ( !qry.exec( QString( "BEGIN\nDBMS_WM.GotoWorkspace(%1);\nEND;" ).arg( quotedValue( workspace ) ) ) )`
	`126`	`+ if ( !qry.prepare( QString( "BEGIN\nDBMS_WM.GotoWorkspace(?);\nEND;" ) ) \|\| !( qry.addBindValue( workspace ), qry.exec() ) )`
`127`	`127`	`{`
`128`	`128`	`mDatabase.close();`
`129`	`129`	`QgsMessageLog::logMessage( tr( "Could not switch to workspace %1 [%2]" ).arg( workspace, qry.lastError().databaseText() ), tr( "Oracle" ) );`
`@@ -172,11 +172,22 @@ void QgsOracleConn::disconnect()`
`172`	`172`	`deleteLater();`
`173`	`173`	`}`
`174`	`174`
`175`		`-bool QgsOracleConn::exec( QSqlQuery &qry, QString sql )`
	`175`	`+bool QgsOracleConn::exec( QSqlQuery &qry, QString sql, const QVariantList &params )`
`176`	`176`	`{`
`177`	`177`	`QgsDebugMsgLevel( QString( "SQL: %1" ).arg( sql ), 4 );`
`178`	`178`
`179`		`- bool res = qry.exec( sql );`
	`179`	`+ bool res = qry.prepare( sql );`
	`180`	`+ if ( res )`
	`181`	`+ {`
	`182`	`+ for ( const auto &param: params )`
	`183`	`+ {`
	`184`	`+ QgsDebugMsgLevel( QString( " ARG: %1 [%2]" ).arg( param.toString() ).arg( param.typeName() ), 4 );`
	`185`	`+ qry.addBindValue( param );`
	`186`	`+ }`
	`187`	`+`
	`188`	`+ res = qry.exec();`
	`189`	`+ }`
	`190`	`+`
`180`	`191`	`if ( !res )`
`181`	`192`	`{`
`182`	`193`	`QgsDebugMsg( QString( "SQL: %1\nERROR: %2" )`
`@@ -192,10 +203,10 @@ QStringList QgsOracleConn::pkCandidates( QString ownerName, QString viewName )`
`192`	`203`	`QStringList cols;`
`193`	`204`
`194`	`205`	`QSqlQuery qry( mDatabase );`
`195`		`- if ( !exec( qry, QString( "SELECT column_name FROM all_tab_columns WHERE owner=%1 AND table_name=%2 ORDER BY column_id" )`
`196`		`- .arg( quotedValue( ownerName ) ).arg( quotedValue( viewName ) ) ) )`
	`206`	`+ if ( !exec( qry, QString( "SELECT column_name FROM all_tab_columns WHERE owner=? AND table_name=? ORDER BY column_id" ),`
	`207`	`+ QVariantList() << ownerName << viewName ) )`
`197`	`208`	`{`
`198`		`- QgsMessageLog::logMessage( tr( "SQL:%1\nerror:%2\n" ).arg( qry.lastQuery() ).arg( qry.lastError().text() ), tr( "Oracle" ) );`
	`209`	`+ QgsMessageLog::logMessage( tr( "SQL:%1 [owner:%2 table_name:%3]\nerror:%4\n" ).arg( qry.lastQuery(), qry.lastError().text(), ownerName, viewName ), tr( "Oracle" ) );`
`199`	`210`	`return cols;`
`200`	`211`	`}`
`201`	`212`
`@@ -242,7 +253,7 @@ bool QgsOracleConn::tableInfo( bool geometryColumnsOnly, bool userTablesOnly, bo`
`242`	`253`	`// sql += " ORDER BY owner,isview,table_name,column_name";`
`243`	`254`
`244`	`255`	`QSqlQuery qry( mDatabase );`
`245`		`- if ( !exec( qry, sql ) )`
	`256`	`+ if ( !exec( qry, sql, QVariantList() ) )`
`246`	`257`	`{`
`247`	`258`	`QgsMessageLog::logMessage( tr( "Querying available tables failed.\nSQL:%1\nerror:%2\n" ).arg( qry.lastQuery() ).arg( qry.lastError().text() ), tr( "Oracle" ) );`
`248`	`259`	`return false;`
`@@ -451,7 +462,7 @@ void QgsOracleConn::retrieveLayerTypes( QgsOracleLayerProperty &layerProperty, b`
`451`	`462`	`if ( !exec( qry, sql`
`452`	`463`	`.arg( quotedIdentifier( layerProperty.geometryColName ) )`
`453`	`464`	`.arg( table )`
`454`		`- .arg( where.isEmpty() ? "" : QString( " AND (%1)" ).arg( where ) ) ) )`
	`465`	`+ .arg( where.isEmpty() ? "" : QString( " AND (%1)" ).arg( where ) ), QVariantList() ) )`
`455`	`466`	`{`
`456`	`467`	`QgsMessageLog::logMessage( tr( "SQL:%1\nerror:%2\n" )`
`457`	`468`	`.arg( qry.lastQuery() )`
`@@ -809,7 +820,7 @@ bool QgsOracleConn::hasSpatial()`
`809`	`820`	`if ( mHasSpatial == -1 )`
`810`	`821`	`{`
`811`	`822`	`QSqlQuery qry( mDatabase );`
`812`		`- mHasSpatial = exec( qry, "SELECT 1 FROM v$option WHERE parameter='Spatial' AND value='TRUE'" ) && qry.next();`
	`823`	`+ mHasSpatial = exec( qry, "SELECT 1 FROM v$option WHERE parameter='Spatial' AND value='TRUE'", QVariantList() ) && qry.next();`
`813`	`824`	`}`
`814`	`825`
`815`	`826`	`return mHasSpatial;`
`@@ -820,7 +831,7 @@ QString QgsOracleConn::currentUser()`
`820`	`831`	`if ( mCurrentUser.isNull() )`
`821`	`832`	`{`
`822`	`833`	`QSqlQuery qry( mDatabase );`
`823`		`- if ( exec( qry, "SELECT user FROM dual" ) && qry.next() )`
	`834`	`+ if ( exec( qry, "SELECT user FROM dual", QVariantList() ) && qry.next() )`
`824`	`835`	`{`
`825`	`836`	`mCurrentUser = qry.value( 0 ).toString();`
`826`	`837`	`}`
Original file line number	Diff line number	Diff line change
`@@ -38,6 +38,7 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour`
`38`	`38`	`return;`
`39`	`39`	`}`
`40`	`40`
	`41`	`+ QVariantList args;`
`41`	`42`	`mQry = QSqlQuery( *mConnection );`
`42`	`43`
`43`	`44`	`if ( mRequest.flags() & QgsFeatureRequest::SubsetOfAttributes )`
`@@ -79,17 +80,15 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour`
`79`	`80`	`if ( mSource->mHasSpatialIndex )`
`80`	`81`	`{`
`81`	`82`	`QgsRectangle rect( mRequest.filterRect() );`
`82`		`- QString bbox = QString( "mdsys.sdo_geometry(2003,%1,NULL,"`
`83`		`- "mdsys.sdo_elem_info_array(1,1003,3),"`
`84`		`- "mdsys.sdo_ordinate_array(%2,%3,%4,%5)"`
`85`		`- ")" )`
`86`		`- .arg( mSource->mSrid < 1 ? "NULL" : QString::number( mSource->mSrid ) )`
`87`		`- .arg( qgsDoubleToString( rect.xMinimum() ) )`
`88`		`- .arg( qgsDoubleToString( rect.yMinimum() ) )`
`89`		`- .arg( qgsDoubleToString( rect.xMaximum() ) )`
`90`		`- .arg( qgsDoubleToString( rect.yMaximum() ) );`
`91`		`-`
`92`		`- whereClause = QString( "sdo_filter(%1,%2)='TRUE'" ).arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) ).arg( bbox );`
	`83`	`+ QString bbox = QStringLiteral( "mdsys.sdo_geometry(2003,?,NULL,"`
	`84`	`+ "mdsys.sdo_elem_info_array(1,1003,3),"`
	`85`	`+ "mdsys.sdo_ordinate_array(?,?,?,?)"`
	`86`	`+ ")" );`
	`87`	`+`
	`88`	`+ whereClause = QStringLiteral( "sdo_filter(%1,%2)='TRUE'" )`
	`89`	`+ .arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) ).arg( bbox );`
	`90`	`+`
	`91`	`+ args << ( mSource->mSrid < 1 ? QVariant( QVariant::Int ) : mSource->mSrid ) << rect.xMinimum() << rect.yMinimum() << rect.xMaximum() << rect.yMaximum();`
`93`	`92`
`94`	`93`	`if (( mRequest.flags() & QgsFeatureRequest::ExactIntersect ) != 0 )`
`95`	`94`	`{`
`@@ -99,6 +98,7 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour`
`99`	`98`	`whereClause += QString( " AND sdo_relate(%1,%2,'mask=ANYINTERACT')='TRUE'" )`
`100`	`99`	`.arg( QgsOracleProvider::quotedIdentifier( mSource->mGeometryColumn ) )`
`101`	`100`	`.arg( bbox );`
	`101`	`+ args << ( mSource->mSrid < 1 ? QVariant( QVariant::Int ) : mSource->mSrid ) << rect.xMinimum() << rect.yMinimum() << rect.xMaximum() << rect.yMaximum();`
`102`	`102`	`}`
`103`	`103`	`else`
`104`	`104`	`{`
`@@ -123,14 +123,14 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour`
`123`	`123`	`{`
`124`	`124`	`case QgsFeatureRequest::FilterFid:`
`125`	`125`	`{`
`126`		`- QString fidWhereClause = QgsOracleUtils::whereClause( mRequest.filterFid(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared );`
	`126`	`+ QString fidWhereClause = QgsOracleUtils::whereClause( mRequest.filterFid(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared, args );`
`127`	`127`	`whereClause = QgsOracleUtils::andWhereClauses( whereClause, fidWhereClause );`
`128`	`128`	`}`
`129`	`129`	`break;`
`130`	`130`
`131`	`131`	`case QgsFeatureRequest::FilterFids:`
`132`	`132`	`{`
`133`		`- QString fidsWhereClause = QgsOracleUtils::whereClause( mRequest.filterFids(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared );`
	`133`	`+ QString fidsWhereClause = QgsOracleUtils::whereClause( mRequest.filterFids(), mSource->mFields, mSource->mPrimaryKeyType, mSource->mPrimaryKeyAttrs, mSource->mShared, args );`
`134`	`134`	`whereClause = QgsOracleUtils::andWhereClauses( whereClause, fidsWhereClause );`
`135`	`135`	`}`
`136`	`136`	`break;`
`@@ -205,14 +205,15 @@ QgsOracleFeatureIterator::QgsOracleFeatureIterator( QgsOracleFeatureSource* sour`
`205`	`205`	`if ( !whereClause.isEmpty() )`
`206`	`206`	`whereClause += " AND ";`
`207`	`207`
`208`		`- whereClause += QString( "rownum<=%1" ).arg( mRequest.limit() );`
`209`		`- fallbackStatement += QString( "rownum<=%1" ).arg( mRequest.limit() );`
	`208`	`+ whereClause += QStringLiteral( "rownum<=?" );`
	`209`	`+ fallbackStatement += QStringLiteral( "rownum<=?" );`
	`210`	`+ args << QVariant::fromValue( mRequest.limit() );`
`210`	`211`	`}`
`211`	`212`
`212`		`- bool result = openQuery( whereClause, !useFallback );`
	`213`	`+ bool result = openQuery( whereClause, args, !useFallback );`
`213`	`214`	`if ( !result && useFallback )`
`214`	`215`	`{`
`215`		`- result = openQuery( fallbackStatement );`
	`216`	`+ result = openQuery( fallbackStatement, args );`
`216`	`217`	`if ( result )`
`217`	`218`	`{`
`218`	`219`	`mExpressionCompiled = false;`
`@@ -249,7 +250,7 @@ bool QgsOracleFeatureIterator::fetchFeature( QgsFeature& feature )`
`249`	`250`	`if ( mRewind )`
`250`	`251`	`{`
`251`	`252`	`mRewind = false;`
`252`		`- if ( !QgsOracleProvider::exec( mQry, mSql ) )`
	`253`	`+ if ( !QgsOracleProvider::exec( mQry, mSql, mArgs ) )`
`253`	`254`	`{`
`254`	`255`	`QgsMessageLog::logMessage( QObject::tr( "Fetching features failed.\nSQL:%1\nError: %2" )`
`255`	`256`	`.arg( mQry.lastQuery() )`
`@@ -418,14 +419,14 @@ bool QgsOracleFeatureIterator::close()`
`418`	`419`
`419`	`420`	`if ( mConnection )`
`420`	`421`	`QgsOracleConnPool::instance()->releaseConnection( mConnection );`
`421`		`- mConnection = 0;`
	`422`	`+ mConnection = nullptr;`
`422`	`423`
`423`	`424`	`iteratorClosed();`
`424`	`425`
`425`	`426`	`return true;`
`426`	`427`	`}`
`427`	`428`
`428`		`-bool QgsOracleFeatureIterator::openQuery( QString whereClause, bool showLog )`
	`429`	`+bool QgsOracleFeatureIterator::openQuery( QString whereClause, QVariantList args, bool showLog )`
`429`	`430`	`{`
`430`	`431`	`try`
`431`	`432`	`{`
`@@ -478,7 +479,8 @@ bool QgsOracleFeatureIterator::openQuery( QString whereClause, bool showLog )`
`478`	`479`
`479`	`480`	`QgsDebugMsg( QString( "Fetch features: %1" ).arg( query ) );`
`480`	`481`	`mSql = query;`
`481`		`- if ( !QgsOracleProvider::exec( mQry, query ) )`
	`482`	`+ mArgs = args;`
	`483`	`+ if ( !QgsOracleProvider::exec( mQry, query, args ) )`
`482`	`484`	`{`
`483`	`485`	`if ( showLog )`
`484`	`486`	`{`