Prepared statements for DG services

Convert sql queries to prepared statements in other
parts of appc.

Change-Id: If29225394de2ab286e4f2f7bdd17f6af6b286576
Signed-off-by: Patrick Brady <patrick.brady@att.com>
Issue-ID: OJSI-25

3 files changed, 480 insertions, 55 deletions

diff --git a/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/CtxParameterizedResolver.java b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/CtxParameterizedResolver.java
new file mode 100644
index 000000000..6582461da
--- /dev/null
+++ b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/CtxParameterizedResolver.java
@@ -0,0 +1,230 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP : APPC
+ * ================================================================================
+ * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END=========================================================
+ */
+
+
+package org.onap.appc.flow.controller.dbervices;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.ResultSetMetaData;
+import java.sql.SQLException;
+import java.util.ArrayList;
+
+import javax.sql.rowset.CachedRowSet;
+
+import org.apache.commons.lang3.StringUtils;
+import org.onap.ccsdk.sli.core.dblib.DbLibService;
+import org.onap.ccsdk.sli.core.sli.SvcLogicContext;
+
+import com.att.eelf.configuration.EELFLogger;
+import com.att.eelf.configuration.EELFManager;
+
+public class CtxParameterizedResolver {
+
+    private static String CRYPT_KEY = "QtfJMKggVk";
+    private static final EELFLogger log = EELFManager.getInstance().getLogger(CtxParameterizedResolver.class);
+    
+    protected static String resolveCtxVars(String key, SvcLogicContext ctx, ArrayList<String> arguments) {
+        if (key == null) {
+            return (null);
+        }
+
+        if (key.startsWith("'") && key.endsWith("'")) {
+            key = key.substring(1, key.length() - 1);
+            log.debug("Stripped outer single quotes - key is now [" + key + "]");
+        }
+
+        String[] keyTerms = key.split("\\s+");
+
+        StringBuffer sqlBuffer = new StringBuffer();
+
+        for (int i = 0; i < keyTerms.length; i++) {
+            sqlBuffer.append(resolveTerm(keyTerms[i], ctx, arguments));
+            sqlBuffer.append(" ");
+        }
+
+        return (sqlBuffer.toString());
+    }
+
+    private static String resolveTerm(String term, SvcLogicContext ctx, ArrayList<String> arguments) {
+        if (term == null) {
+            return (null);
+        }
+
+        log.trace("resolveTerm: term is " + term);
+
+        if (term.startsWith("$") && (ctx != null)) {
+            // Resolve any index variables.
+            term = resolveCtxVariable(term.substring(1), ctx);
+            // Escape single quote
+            if (term != null) {
+                term = term.replaceAll("'", "''");
+            }
+            //valueOf will store null values as a String "null"
+            arguments.add(String.valueOf(term));
+            return "?";
+        } else {
+            return (term);
+        }
+
+    }
+
+    private static String resolveCtxVariable(String ctxVarName, SvcLogicContext ctx) {
+
+        if (ctxVarName.indexOf('[') == -1) {
+            // Ctx variable contains no arrays
+            if ("CRYPT_KEY".equals(ctxVarName)) {
+                // Handle crypt key as special case. If it's set as a context
+                // variable, use it. Otherwise, use
+                // configured crypt key.
+                String cryptKey = ctx.getAttribute(ctxVarName);
+                if ((cryptKey != null) && (cryptKey.length() > 0)) {
+                    return (cryptKey);
+                } else {
+                    return (CRYPT_KEY);
+                }
+            }
+            return (ctx.getAttribute(ctxVarName));
+        }
+
+        // Resolve any array references
+        StringBuffer sbuff = new StringBuffer();
+        String[] ctxVarParts = ctxVarName.split("\\[");
+        sbuff.append(ctxVarParts[0]);
+        for (int i = 1; i < ctxVarParts.length; i++) {
+            if (ctxVarParts[i].startsWith("$")) {
+                int endBracketLoc = ctxVarParts[i].indexOf("]");
+                if (endBracketLoc == -1) {
+                    // Missing end bracket ... give up parsing
+                    log.warn("Variable reference " + ctxVarName + " seems to be missing a ']'");
+                    return (ctx.getAttribute(ctxVarName));
+                }
+
+                String idxVarName = ctxVarParts[i].substring(1, endBracketLoc);
+                String remainder = ctxVarParts[i].substring(endBracketLoc);
+
+                sbuff.append("[");
+                sbuff.append(ctx.getAttribute(idxVarName));
+                sbuff.append(remainder);
+
+            } else {
+                // Index is not a variable reference
+                sbuff.append("[");
+                sbuff.append(ctxVarParts[i]);
+            }
+        }
+
+        return (ctx.getAttribute(sbuff.toString()));
+    }
+        
+        protected static void saveCachedRowSetToCtx(CachedRowSet results, SvcLogicContext ctx, String prefix, DbLibService dblibSvc)
+                throws SQLException {
+            if (ctx != null) {
+                if ((prefix != null) && prefix.endsWith("[]")) {
+                    // Return an array.
+                    String pfx = prefix.substring(0, prefix.length() - 2);
+                    int idx = 0;
+                    do {
+                        ResultSetMetaData rsMeta = results.getMetaData();
+                        int numCols = rsMeta.getColumnCount();
+
+                        for (int i = 0; i < numCols; i++) {
+                            String colValue = null;
+                            String tableName = rsMeta.getTableName(i + 1);
+                            if (rsMeta.getColumnType(i + 1) == java.sql.Types.VARBINARY) {
+                                colValue = decryptColumn(tableName, rsMeta.getColumnName(i + 1), results.getBytes(i + 1),
+                                        dblibSvc);
+                            } else {
+                                colValue = results.getString(i + 1);
+                            }
+                            log.debug("Setting " + pfx + "[" + idx + "]."
+                                    + rsMeta.getColumnLabel(i + 1).replaceAll("_", "-") + " = " + colValue);
+                            ctx.setAttribute(pfx + "[" + idx + "]." + rsMeta.getColumnLabel(i + 1).replaceAll("_", "-"),
+                                    colValue);
+                        }
+                        idx++;
+                    } while (results.next());
+                    log.debug("Setting " + pfx + "_length = " + idx);
+                    ctx.setAttribute(pfx + "_length", "" + idx);
+                } else {
+                    ResultSetMetaData rsMeta = results.getMetaData();
+                    int numCols = rsMeta.getColumnCount();
+
+                    for (int i = 0; i < numCols; i++) {
+                        String colValue = null;
+                        String tableName = rsMeta.getTableName(i + 1);
+                        if ("VARBINARY".equalsIgnoreCase(rsMeta.getColumnTypeName(i + 1))) {
+                            colValue = decryptColumn(tableName, rsMeta.getColumnName(i + 1), results.getBytes(i + 1),
+                                    dblibSvc);
+                        } else {
+                            colValue = results.getString(i + 1);
+                        }
+                        if (prefix != null) {
+                            log.debug("Setting " + prefix + "." + rsMeta.getColumnLabel(i + 1).replaceAll("_", "-") + " = "
+                                    + colValue);
+                            ctx.setAttribute(prefix + "." + rsMeta.getColumnLabel(i + 1).replaceAll("_", "-"), colValue);
+                        } else {
+                            log.debug("Setting " + rsMeta.getColumnLabel(i + 1).replaceAll("_", "-") + " = " + colValue);
+                            ctx.setAttribute(rsMeta.getColumnLabel(i + 1).replaceAll("_", "-"), colValue);
+                        }
+                    }
+                }
+            }
+        }
+        
+        private static String decryptColumn(String tableName, String colName, byte[] colValue, DbLibService dblibSvc) {
+            String strValue = new String(colValue);
+
+            if (StringUtils.isAsciiPrintable(strValue)) {
+
+                // If printable, not encrypted
+                return (strValue);
+            } else {
+                ResultSet results = null;
+                try (Connection conn =  dblibSvc.getConnection();
+                   PreparedStatement stmt = conn.prepareStatement("SELECT CAST(AES_DECRYPT(?, ?) AS CHAR(50)) FROM DUAL")) {
+
+                    stmt.setBytes(1, colValue);
+                    stmt.setString(2, CRYPT_KEY);
+                    results = stmt.executeQuery();
+
+                    if ((results != null) && results.next()) {
+                        strValue = results.getString(1);
+                        log.debug("Decrypted value is " + strValue);
+                    } else {
+                        log.warn("Cannot decrypt " + tableName + "." + colName);
+                    }
+                } catch (Exception e) {
+                    log.error("Caught exception trying to decrypt " + tableName + "." + colName, e);
+                }finally {
+                    if (results != null) {
+                        try {
+                            results.close();
+                        } catch (SQLException se) {
+                            log.error("Caught exception trying to close ResultSet",se);
+                        }
+                    }
+                }
+            }
+            return (strValue);
+        }
+}
diff --git a/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/DbLibServiceQueries.java b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/DbLibServiceQueries.java
new file mode 100644
index 000000000..9530da147
--- /dev/null
+++ b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/DbLibServiceQueries.java
@@ -0,0 +1,182 @@
+/*-
+ * ============LICENSE_START=======================================================
+ * ONAP : APPC
+ * ================================================================================
+ * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
+ * ================================================================================
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * ============LICENSE_END=========================================================
+ */
+
+package org.onap.appc.flow.controller.dbervices;
+
+import java.sql.SQLException;
+import java.util.ArrayList;
+
+import javax.sql.rowset.CachedRowSet;
+
+import org.onap.ccsdk.sli.core.dblib.DBResourceManager;
+import org.onap.ccsdk.sli.core.dblib.DbLibService;
+import org.onap.ccsdk.sli.core.sli.SvcLogicContext;
+import org.onap.ccsdk.sli.core.sli.SvcLogicResource.QueryStatus;
+import org.onap.ccsdk.sli.core.sli.provider.SvcLogicService;
+import org.osgi.framework.Bundle;
+import org.osgi.framework.BundleContext;
+import org.osgi.framework.FrameworkUtil;
+import org.osgi.framework.ServiceReference;
+
+import com.att.eelf.configuration.EELFLogger;
+import com.att.eelf.configuration.EELFManager;
+
+public class DbLibServiceQueries {
+    
+    private static final String DBLIB_SERVICE = "org.onap.ccsdk.sli.core.dblib.DbLibService";
+    private static final EELFLogger log = EELFManager.getInstance().getLogger(DbLibServiceQueries.class);
+    
+    DbLibService dbLibService;
+    
+    public DbLibServiceQueries() {
+        this.dbLibService = getDbLibService();
+        if(this.dbLibService == null) {
+            throw new NullPointerException("DbLibService reference not found");
+        }
+    }
+    
+    public DbLibServiceQueries(DbLibService dbLibService) {
+        this.dbLibService = dbLibService;
+        if(this.dbLibService == null) {
+            throw new NullPointerException("Provided DbLibService is null");
+        }
+    }
+    
+    public DbLibServiceQueries(DbLibService dbLibService, boolean allowNull) {
+        this.dbLibService = dbLibService;
+        if(this.dbLibService == null && !allowNull) {
+            throw new NullPointerException("Provided DbLibService is null");
+        }
+    }
+    
+    public QueryStatus query(String query, SvcLogicContext ctx) {
+        ArrayList<String> arguments = new ArrayList<>();
+        query = CtxParameterizedResolver.resolveCtxVars(query, ctx, arguments);
+        return performQuery(query, ctx, null, arguments);
+    }
+    
+    public QueryStatus query(String query, String prefix, SvcLogicContext ctx) {
+        ArrayList<String> arguments = new ArrayList<>();
+        query = CtxParameterizedResolver.resolveCtxVars(query, ctx, arguments);
+        return performQuery(query, ctx, prefix, arguments);
+    }
+    
+    public QueryStatus query(String query, SvcLogicContext ctx, ArrayList<String> arguments) {
+        return performQuery(query, ctx, null, valueOfArrayList(arguments));
+    }
+    public QueryStatus query(String query, SvcLogicContext ctx, String prefix, ArrayList<String> arguments) {
+        return performQuery(query, ctx, prefix, valueOfArrayList(arguments));
+    }
+    
+    private QueryStatus performQuery(String query, SvcLogicContext ctx, String prefix, ArrayList<String> arguments) {
+        
+        CachedRowSet result = null;
+        try {
+            result = dbLibService.getData(query, arguments, null);
+            if (!result.next()) {
+                log.debug("No data found");
+                return QueryStatus.NOT_FOUND;
+            } else {
+                CtxParameterizedResolver.saveCachedRowSetToCtx(result, ctx, prefix, dbLibService);
+            }
+        } catch (SQLException e) {
+            log.error("Exception in query()",e);
+            return QueryStatus.FAILURE;
+        }
+        return QueryStatus.SUCCESS;
+        
+    }
+    public QueryStatus save(String query, SvcLogicContext ctx) {
+        ArrayList<String> arguments = new ArrayList<>();
+        query = CtxParameterizedResolver.resolveCtxVars(query, ctx, arguments);
+        return performSave(query, arguments);
+    }
+    
+    public QueryStatus save(String query, SvcLogicContext ctx, ArrayList<String> arguments) {
+        return performSave(query, valueOfArrayList(arguments));
+    }
+    
+    private QueryStatus performSave(String query, ArrayList<String> arguments) {
+        boolean success = false;
+        try {
+            success = dbLibService.writeData(query, arguments, null);
+        } catch (SQLException e) {
+            log.error("Exception in save()",e);
+            success = false;
+        }
+        if(success) {
+            return QueryStatus.SUCCESS;
+        }
+        return QueryStatus.FAILURE;
+    }
+    
+    private static DbLibService getDbLibService() {
+        
+        DbLibService dbLibService = null;
+        BundleContext bundleContext = null;
+        ServiceReference serviceRef = null;
+
+        Bundle bundle =  FrameworkUtil.getBundle(SvcLogicService.class);
+
+        if (bundle != null) {
+            bundleContext = bundle.getBundleContext();
+        }
+
+        if (bundleContext != null) {
+            log.debug("Getting bundle Context");
+            serviceRef = bundleContext.getServiceReference(DBLIB_SERVICE);
+        }
+
+        if (serviceRef == null) {
+            log.warn("Could not find service reference for DBLib service");
+                    
+        } else {
+            dbLibService = (DbLibService)bundleContext.getService(serviceRef);
+            if (dbLibService == null) {
+                log.warn("DBLIB_SERVICE is null");
+            }
+        }
+        if (dbLibService == null) {
+            try {
+                dbLibService = new DBResourceManager(System.getProperties());
+            } catch (Exception e) {
+                log.error("Caught exception trying to create db service", e);
+            }
+
+            if (dbLibService == null) {
+                log.warn("Could not create new DBResourceManager");
+            }
+        }
+        return dbLibService;
+    }
+    
+    //By using String.valueOf on the array list items, we can store any null values as
+    //Strings with the value "null". This mirrors the way queries worked prior to the
+    //prepared statements.
+    private ArrayList<String> valueOfArrayList(ArrayList<String> original) {
+        ArrayList<String> valueOfList = new ArrayList<>();
+        for(String s : original) {
+            valueOfList.add(String.valueOf(s));
+        }
+        return valueOfList;
+    }
+
+}
diff --git a/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/FlowControlDBService.java b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/FlowControlDBService.java
index 946df7ce2..47228eae1 100644
--- a/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/FlowControlDBService.java
+++ b/appc-config/appc-flow-controller/provider/src/main/java/org/onap/appc/flow/controller/dbervices/FlowControlDBService.java
@@ -24,12 +24,15 @@ package org.onap.appc.flow.controller.dbervices;
 
 import com.att.eelf.configuration.EELFLogger;
 import com.att.eelf.configuration.EELFManager;
+
+import java.util.ArrayList;
 import java.util.Map;
 import org.apache.commons.lang.StringUtils;
 import org.onap.appc.flow.controller.data.Transaction;
 import org.onap.appc.flow.controller.utils.EscapeUtils;
 import org.onap.appc.flow.controller.utils.FlowControllerConstants;
 import org.onap.ccsdk.sli.adaptors.resource.sql.SqlResource;
+import org.onap.ccsdk.sli.core.dblib.DbLibService;
 import org.onap.ccsdk.sli.core.sli.SvcLogicContext;
 import org.onap.ccsdk.sli.core.sli.SvcLogicException;
 import org.onap.ccsdk.sli.core.sli.SvcLogicResource;
@@ -41,27 +44,24 @@ public class FlowControlDBService {
     private static final String QUERY_STR = "Query String : ";
     private static final String FAILURE_PARAM = "FAILURE";
     protected static final String GET_FLOW_REF_DATA_ERROR = "Error - while getting FlowReferenceData ";
-    private static final String SELECT_AS_QUERY_STR = "select max(internal_version) as maxInternalVersion, artifact_name as artifactName from ";
-    private static final String WHERE_ART_NAME_QUERY_STR = " where artifact_name in (select artifact_name from ";
-    private static final String WHERE_VNF_TYPE_QUERY_STR = " where vnf_type= $";
-    private static final String SELECT_ART_CONTENT_QUERY_STR = "select artifact_content from ";
-    private static final String WHERE_ARTIFACT_NAME_QUERY_STR = " where artifact_name = $artifactName  and internal_version = $maxInternalVersion ";
     private static final String ARTIFACT_CONTENT_PARAM = "artifact-content";
     protected static final String COUNT_PROTOCOL_PARAM = "count(protocol)";
-    private static final String WHERE_ACTION_QUERY_STR = " where action = '";
-    private static final String AND_ACTION_LEVEL_QUERY_STR = " and action_level = '";
 
-    private SvcLogicResource serviceLogic;
+    private DbLibServiceQueries dblib;
     private static FlowControlDBService dgGeneralDBService = null;
 
     private FlowControlDBService() {
-        if (serviceLogic == null) {
-            serviceLogic = new SqlResource();
+        if (dblib== null) {
+            dblib = new DbLibServiceQueries();
         }
     }
 
-    protected FlowControlDBService(SqlResource svcLogic) {
-            serviceLogic = svcLogic;
+    protected FlowControlDBService(DbLibServiceQueries dbLibServiceQueries) {
+            dblib = dbLibServiceQueries;
+    }
+    
+    protected FlowControlDBService(DbLibService dbLibService) {
+        dblib = new DbLibServiceQueries(dbLibService);
     }
 
     public static FlowControlDBService initialise() {
@@ -82,11 +82,11 @@ public class FlowControlDBService {
         }
 
         QueryStatus status;
-        if (serviceLogic != null && localContext != null) {
+        if (dblib != null && localContext != null) {
             String key = "select SEQUENCE_TYPE, CATEGORY, GENERATION_NODE, EXECUTION_NODE from "
                 + FlowControllerConstants.DB_MULTISTEP_FLOW_REFERENCE + whereClause;
             log.debug(fn + QUERY_STR + key);
-            status = serviceLogic.query("SQL", false, null, key, null, null, localContext);
+            status = dblib.query(key, localContext);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
             }
@@ -100,28 +100,28 @@ public class FlowControlDBService {
     public String getDesignTimeFlowModel(SvcLogicContext localContext) throws SvcLogicException {
         String fn = "DBService.getDesignTimeFlowModel ";
         QueryStatus status;
-        if (serviceLogic != null && localContext != null) {
+        if (dblib != null && localContext != null) {
             String queryString =
-                SELECT_AS_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_ARTIFACTS + WHERE_ART_NAME_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_REFERENCE + WHERE_VNF_TYPE_QUERY_STR
+                "select max(internal_version) as maxInternalVersion, artifact_name as artifactName from "
+                    + FlowControllerConstants.DB_SDC_ARTIFACTS + " where artifact_name in (select artifact_name from "
+                    + FlowControllerConstants.DB_SDC_REFERENCE + " where vnf_type= $"
                     + FlowControllerConstants.VNF_TYPE
                     + " and  vnfc_type = $" + FlowControllerConstants.VNFC_TYPE + " and  action = $"
                     + FlowControllerConstants.REQUEST_ACTION + " and file_category =  $"
                     + FlowControllerConstants.CATEGORY + " )";
 
             log.debug(fn + QUERY_STR + queryString);
-            status = serviceLogic.query("SQL", false, null, queryString, null, null, localContext);
+            status = dblib.query(queryString, localContext);
 
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
             }
 
-            String queryString1 = SELECT_ART_CONTENT_QUERY_STR + FlowControllerConstants.DB_SDC_ARTIFACTS
-                + WHERE_ARTIFACT_NAME_QUERY_STR;
+            String queryString1 = "select artifact_content from " + FlowControllerConstants.DB_SDC_ARTIFACTS
+                + " where artifact_name = $artifactName  and internal_version = $maxInternalVersion ";
 
             log.debug(fn + QUERY_STR + queryString1);
-            status = serviceLogic.query("SQL", false, null, queryString1, null, null, localContext);
+            status = dblib.query(queryString1, localContext);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
             }
@@ -154,7 +154,7 @@ public class FlowControlDBService {
                 + " , updated_date = sysdate() ";
 
             log.debug(fn + QUERY_STR + queryString);
-            status = serviceLogic.save("SQL", false, false, queryString, null, null, localContext);
+            status = dblib.save(queryString, localContext);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException("Error While processing storing Artifact: "
                     + localContext.getAttribute(FlowControllerConstants.ARTIFACT_NAME));
@@ -171,12 +171,15 @@ public class FlowControlDBService {
         String protocolType = getProtocolType(transaction, vnfType, fn, context);
 
         String key = "select execution_type, execution_module, execution_rpc from "
-            + FlowControllerConstants.DB_PROCESS_FLOW_REFERENCE + WHERE_ACTION_QUERY_STR + transaction.getAction()
-            + "'" + AND_ACTION_LEVEL_QUERY_STR + transaction.getActionLevel() + "'" + " and protocol = '"
-            + protocolType + "'";
+            + FlowControllerConstants.DB_PROCESS_FLOW_REFERENCE + " where action = ? "
+            + "and action_level = ? and protocol = ?";
+        ArrayList<String> arguments = new ArrayList<>();
+        arguments.add(transaction.getAction());
+        arguments.add(transaction.getActionLevel());
+        arguments.add(protocolType);
 
         log.debug(fn + QUERY_STR + key);
-        status = serviceLogic.query("SQL", false, null, key, null, null, context);
+        status = dblib.query(key, context, arguments);
         if (status.toString().equals(FAILURE_PARAM)) {
             throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
         }
@@ -193,11 +196,13 @@ public class FlowControlDBService {
         String protocolQuery;
         int protocolCount;
         protocolQuery = "select count(protocol) from " + FlowControllerConstants.DB_PROTOCOL_REFERENCE
-            + WHERE_ACTION_QUERY_STR + transaction.getAction() + "'" + AND_ACTION_LEVEL_QUERY_STR
-            + transaction.getActionLevel() + "'";
+            + " where action = ? and action_level = ?";
+        ArrayList<String> arguments = new ArrayList<>();
+        arguments.add(transaction.getAction());
+        arguments.add(transaction.getActionLevel());
 
         log.debug(fn + QUERY_STR + protocolQuery);
-        status = serviceLogic.query("SQL", false, null, protocolQuery, null, null, context);
+        status = dblib.query(protocolQuery, context, arguments);
         if (status.toString().equals(FAILURE_PARAM)) {
             throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
         }
@@ -208,11 +213,13 @@ public class FlowControlDBService {
 
         if (protocolCount == 1) {
             protocolQuery = "select protocol from " + FlowControllerConstants.DB_PROTOCOL_REFERENCE
-                + WHERE_ACTION_QUERY_STR + transaction.getAction() + "'" + AND_ACTION_LEVEL_QUERY_STR
-                + transaction.getActionLevel() + "'";
+                + " where action = ? and action_level = ?";
+            ArrayList<String> arguments2 = new ArrayList<>();
+            arguments2.add(transaction.getAction());
+            arguments2.add(transaction.getActionLevel());
 
             log.debug(fn + QUERY_STR + protocolQuery);
-            status = serviceLogic.query("SQL", false, null, protocolQuery, null, null, context);
+            status = dblib.query(protocolQuery, context, arguments2);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
             }
@@ -231,11 +238,14 @@ public class FlowControlDBService {
         QueryStatus status;
         int protocolCount;
         protocolQuery = "select count(protocol) from " + FlowControllerConstants.DB_PROTOCOL_REFERENCE
-            + WHERE_ACTION_QUERY_STR + transaction.getAction() + "'" + AND_ACTION_LEVEL_QUERY_STR
-            + transaction.getActionLevel() + "'" + " and vnf_type = '" + vnfType + "'";
+            + " where action = ? and action_level = ? and vnf_type = ?";
+        ArrayList<String> arguments = new ArrayList<>();
+        arguments.add(transaction.getAction());
+        arguments.add(transaction.getActionLevel());
+        arguments.add(vnfType);
 
         log.debug(fn + QUERY_STR + protocolQuery);
-        status = serviceLogic.query("SQL", false, null, protocolQuery, null, null, context);
+        status = dblib.query(protocolQuery, context, arguments);
         if (status.toString().equals(FAILURE_PARAM)) {
             throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
         }
@@ -246,10 +256,13 @@ public class FlowControlDBService {
             throw new SvcLogicException("Got more than 2 values..");
         } else if (protocolCount == 1) {
             protocolQuery = "select protocol from " + FlowControllerConstants.DB_PROTOCOL_REFERENCE
-                + WHERE_ACTION_QUERY_STR + transaction.getAction() + "'" + AND_ACTION_LEVEL_QUERY_STR
-                + transaction.getActionLevel() + "'" + " and vnf_type = '" + vnfType + "'";
+                + " where action = ? and action_level = ? and vnf_type = ?";
+            ArrayList<String> arguments2 = new ArrayList<>();
+            arguments2.add(transaction.getAction());
+            arguments2.add(transaction.getActionLevel());
+            arguments2.add(vnfType);
             log.debug(fn + QUERY_STR + protocolQuery);
-            status = serviceLogic.query("SQL", false, null, protocolQuery, null, null, context);
+            status = dblib.query(protocolQuery, context, arguments2);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException(GET_FLOW_REF_DATA_ERROR);
             }
@@ -261,26 +274,26 @@ public class FlowControlDBService {
     public String getDependencyInfo(SvcLogicContext localContext) throws SvcLogicException {
         String fn = "DBService.getDependencyInfo ";
         QueryStatus status;
-        if (serviceLogic != null && localContext != null) {
+        if (dblib != null && localContext != null) {
             String queryString =
-                SELECT_AS_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_ARTIFACTS + WHERE_ART_NAME_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_REFERENCE + WHERE_VNF_TYPE_QUERY_STR
+                "select max(internal_version) as maxInternalVersion, artifact_name as artifactName from "
+                    + FlowControllerConstants.DB_SDC_ARTIFACTS + " where artifact_name in (select artifact_name from "
+                    + FlowControllerConstants.DB_SDC_REFERENCE + " where vnf_type= $"
                     + FlowControllerConstants.VNF_TYPE
                     + " and file_category = '" + FlowControllerConstants.DEPENDENCYMODEL + "' )";
 
             log.debug(fn + QUERY_STR + queryString);
-            status = serviceLogic.query("SQL", false, null, queryString, null, null, localContext);
+            status = dblib.query(queryString, localContext);
 
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException("Error - while getting dependencydata ");
             }
 
-            String queryString1 = SELECT_ART_CONTENT_QUERY_STR + FlowControllerConstants.DB_SDC_ARTIFACTS
-                + WHERE_ARTIFACT_NAME_QUERY_STR;
+            String queryString1 = "select artifact_content from " + FlowControllerConstants.DB_SDC_ARTIFACTS
+                + " where artifact_name = $artifactName  and internal_version = $maxInternalVersion ";
 
             log.debug(fn + QUERY_STR + queryString1);
-            status = serviceLogic.query("SQL", false, null, queryString1, null, null, localContext);
+            status = dblib.query(queryString1, localContext);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException("Error - while getting dependencyData ");
             }
@@ -293,26 +306,26 @@ public class FlowControlDBService {
     public String getCapabilitiesData(SvcLogicContext localContext) throws SvcLogicException {
         String fn = "DBService.getCapabilitiesData ";
         QueryStatus status;
-        if (serviceLogic != null && localContext != null) {
+        if (dblib != null && localContext != null) {
             String queryString =
-                SELECT_AS_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_ARTIFACTS + WHERE_ART_NAME_QUERY_STR
-                    + FlowControllerConstants.DB_SDC_REFERENCE + WHERE_VNF_TYPE_QUERY_STR
+                "select max(internal_version) as maxInternalVersion, artifact_name as artifactName from "
+                    + FlowControllerConstants.DB_SDC_ARTIFACTS + " where artifact_name in (select artifact_name from "
+                    + FlowControllerConstants.DB_SDC_REFERENCE + " where vnf_type= $"
                     + FlowControllerConstants.VNF_TYPE
                     + " and file_category = '" + FlowControllerConstants.CAPABILITY + "' )";
 
             log.info(fn + QUERY_STR + queryString);
-            status = serviceLogic.query("SQL", false, null, queryString, null, null, localContext);
+            status = dblib.query(queryString, localContext);
 
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException("Error - while getting capabilitiesData ");
             }
 
-            String queryString1 = SELECT_ART_CONTENT_QUERY_STR + FlowControllerConstants.DB_SDC_ARTIFACTS
-                + WHERE_ARTIFACT_NAME_QUERY_STR;
+            String queryString1 = "select artifact_content from " + FlowControllerConstants.DB_SDC_ARTIFACTS
+                + " where artifact_name = $artifactName  and internal_version = $maxInternalVersion ";
 
             log.debug(fn + QUERY_STR + queryString1);
-            status = serviceLogic.query("SQL", false, null, queryString1, null, null, localContext);
+            status = dblib.query(queryString1, localContext);
             if (status.toString().equals(FAILURE_PARAM)) {
                 throw new SvcLogicException("Error - while getting capabilitiesData ");
             }