Unfortunately, I was on vacation the week before the presentation, so I didn’t get to cover absolutely everything that I wanted to, but I was able to show some great highlights of what can be done with Mongoose. When I first started to look in to it, I was immediately attracted to its syntax and API being very JavaScript friendly.

First things first, though. You can install Mongoose easily by using npm – npm install mongoose.

Then you simply need to include it and create a reference to a local database (if it doesn’t exist, Mongoose will create it for you).

var mongoose = require('mongoose'),
    db = mongoose.connect('mongodb://localhost/test');

Now you’re ready to start working with your database.

One of my favorite things about this system is that you can define, transform, create, and delete all sorts of information without an active database connection. That’s because MongoDB is document based instead of table based.

In the Mongoose API, it all starts with Schemas – something not needed in base MongoDB. A schema is the definition of your document – a rough concept of a table in RDBMS – but instead of all the normalization that goes on in relational systems, documents get embedded in other documents instead of being joined together.

Let’s look at my sample. First, I create an instance of mongoose.Schema and then I create two document schemas – Beer and Type.

var mongoose = require('mongoose'),
    db = mongoose.connect('mongodb://localhost/test'),
    Schema = mongoose.Schema,

    /**
     *  This is the beer type document that is embedded in the beer document
     */
    Type = new Schema({
        name            : String,
        main_ingredient : String
    }),

    /**
     *  This is the beer document which has a sub-document of Type
     */
    Beer = new Schema({
        brand       : String,
        type        : [Type],   // Embed Type into Beer (kinda like join)
        brewery_age : Number,
        rating      : Number
    });

Now that we’ve defined what a beer is, we make a model for it.

BeerModel = mongoose.model('Beer', Beer);

Now that we have a model for beer, we can create instances. Notice that the parameter is simply a JSON object with each property defined… except the Type.

  var Yuengling = new BeerModel({
    brand:'Yuengling',
    brewery_age:105,
    rating: 40
  });

To assign properties to a sub-document you use this syntax.

  Yuengling.type.push({
    name:'Lager',
    main_ingredient:'Malted Barley'
  });

Ok, now that we’ve defined our first beer, let’s save it to the database. No INSERT INTO needed here, it’s absurdly simple. You call the save() method; much more JavaScript friendly syntax. It’s how you would write a save method on any object. Like always in Node – because we never want to block the I/O on our main event loop – you pass an anonymous function that will receive an error message if something went wrong.

Yuengling.save(function(err){
    if (err) { console.log(err); }
  });

Let’s assume, for brevity’s sake – that I’ve added 5 more beers to the database. How would you query it to find beers that have a rating higher than, say, 35? Perhaps the designers of MongoDB live by the K.I.S.S. principle, because you use the find() method. However, the syntax for using operands in the argument list is a bit counter-intuitive.

Let’s find those on our BeerModel.

BeerModel.find({ rating: {$gt: 35} }, function(err, beers) {
   beers.forEach(function(beer){
     console.log(beer);
   });
});

Another feature I really like in Mongoose is you can add methods directly on the schema and then call those methods on any instance. They serve the purpose of a stored procedure in the relational world.

I’m going to modify Beer and create two methods that allow me to increment and decrement the value of it rating property.

    Beer = new Schema({
        brand       : String,
        type        : [Type],   // Embed Type into Beer (kinda like join)
        brewery_age : Number,
        rating      : Number
    }).method('increaseRating', function(){
      this.rating += 1;
      return this.rating;
    }).method('decreaseRating', function(){
      this.rating -= 1;
      return this.rating;
    });

   /**
    * Increase rating of Yuengling
    */
   Yuengling.increaseRating();

   /**
    * Decrese rating of Yuengling
    */
   Yuengling.decreaseRating();

How about a validation trigger? In this case, when you call the save() method with a rating that doesn’t validate, the err argument to the callback function will contain an exception with the message “Rating for beer is not between 10 and 50″.

/**
 * Validate the rating field to be between 10 and 50
 */
Beer.path('rating').validate(function(val){
  return val>10 && val<=50;
}, 'Rating for beer is not between 10 and 50');

These are just scratching the surface of what you can do. At this point in time, the Mongoose API is a bit sparsely documented, but still, if you want to go through the full API you can find everything you need.

You can see my full code on my Github account.

I’ve got a set of data that’s thousands, upon thousands in size that will choke any browser if I try to send the complete set as a JSON string and try to render it, so I’m attempting to page the results.

What I ended up having to do is two-subselects in order to get the paging right.

<cffunction name="getByAttributes" access="public" output="false" returntype="query">
	<cfargument name="attr1" type="numeric" required="false" />
	<cfargument name="attr2" type="string" required="false" />
	<cfargument name="attr3" type="string" required="false" />
	<cfargument name="page" type="numeric" required="false" default="1" />

       <cfset var local = {} />
	<cfset local.rowEnd = arguments.page * 100 />
	<cfset local.rowStart = ((arguments.page - 1) * 100) + 1 />

       <cfquery name="local.pagedQuery" datasource="#variables.datasource.getName()#">
       SELECT
           y.attr1
           y.attr2,
           y.attr3,
       FROM (
           SELECT
               x.attr1,
               x.attr2,
               x.attr3
               rownum r
           FROM (
               SELECT
                   fi.attr1,
                   fi.attr2,
                   fi.attr3
               FROM funny_info fi
               ORDER BY fi.attr2
           ) x where rownum <= <cfqueryparam cfsqltype="cf_sql_integer" value="#local.rowEnd#" />
       ) y where r >= <cfqueryparam cfsqltype="cf_sql_integer" value="#local.rowStart#" />
       </cfquery>

	<cfreturn local.pagedQuery />
</cffunction>

<cfscript>
driverManager = createObject("java","java.sql.DriverManager");

conn = driverManager.getConnection("jdbc:macromedia:oracle://111.11.11.111:1521;SID=mySID;serverName=111.11.11.111;user=**********;password=**********");

stmt = conn.createStatement();
recordSet = stmt.ExecuteQuery("select * from table order by 1 desc");
results = createObject("java", "coldfusion.sql.QueryTable").init(recordSet);
</cfscript>

<cfdump var="#results#">

The trick was to add the username and password as properties of the connection string rather than having them inline.

This fails

driverManager.getConnection("jdbc:macromedia:oracle:username/password/111.11.11.111:1521;SID=mySID;serverName=111.11.11.111;")

After pulling the old code out of my repository, I discovered that I’d used CFQUERYPARAM (I won’t iterate the hundreds of articles you can find by yourself stating, “USE CFQUERYPARAM, DUMMY!!”) in all of my business logic code, so I couldn’t quite figure out what was going on. While perusing the web for other ideas, I ran across Jason Bartholme’s blog entry about preventing SQL injection attacks. He has a simple bit of code that he put in onRequestStart() so check if the keyword DECLARE was in the URL.

<cfif not structIsEmpty(URL) >
   <cfloop list="#StructKeyList(URL)#" index="i">
      <cfif URL[i] CONTAINS "4445434C415245">
         <cfmail to="me@mysite.com" from="them@theirsite.com" subject="SQL Injection Attempt" type="html">
            <cfdump var="#URL#">
            <cfdump var="#CGI#">
         </cfmail>
         <cfabort>
      </cfif>
   </cfloop>
</cfif>

This worked like a charm and allowed me to see what exactly these jerkoffs were doing. Turned out I had left CFQUERYPARAM out of some queries I was running for the Contact Us page and a few product display pages. Once I added the tags, the attacks stopped.

If you’re seeing SQL injection attacks, just add the code to application.cfm or the onRequestStart() function of application.cfc to see if this is the method the attackers are using and what they are doing.

Thanks Jason!

Granted I’m still running the 2001 version of Visio for Enterprise Architects, so I’m sure that recent releases have more formats in which to view an object model. However, for the time being, I’m having fun with opening all my old schemas and changing their format.

To get your model in this format, you choose the following menu option:
Database > Options > Document…

Then in the General tab, select IDEF1X as the symbol set.

Simplistic example:

------------------------------------------------------
3786       01/26/2008      1        3      0578
------------------------------------------------------
3786       01/27/2008      1        3      0579
------------------------------------------------------
3786       01/28/2008      1        3      0581
------------------------------------------------------
3787       01/29/2008      1        3      0587
------------------------------------------------------
3787       01/30/2008      1        3      0591
------------------------------------------------------

I was wracking my brain trying to figure out how, with one query, I could properly aggregate this data into one resultset. Using OVER PARTITION BY, SYS_CONNECT_BY_PATH, and the LEVEL Pseudocolumn, I came up with a pretty slick resultset that groups certain columns from multiple rows into one parent row.

SELECT column1,
   ltrim(column2, '<br/>') column2,
   column3,
   column4,
   ltrim(column5, '<br/>') effective_date
FROM (SELECT row_number() over(PARTITION BY column1 ORDER BY column1, ord_level DESC) aggregateRow,
        column1,
        column2,
        column3,
        column4,
        column5
      FROM (SELECT column1,
                  column3,
                  column4,
                  LEVEL ord_level,
                  sys_connect_by_path(column2, '<br/>') column2,
                  sys_connect_by_path(column5, '<br/>') column5
           FROM (SELECT column1,
                       column2,
                       column3,
                       column4,
                       column5
                       row_number() over(PARTITION BY column1 ORDER BY column1, mapped_facility_no) dataSet
                   FROM   database_table
                   ORDER  BY column1, column3) x_alias
            CONNECT BY column1 = PRIOR column1
            AND dataSet - 1 = PRIOR dataSet
           )
    )
WHERE  aggregateRow = 1
ORDER  BY column1

Resultset:

------------------------------------------------------
          01/26/2008                     0578
3786      01/27/2008      1       3      0579
          01/28/2008                     0581
------------------------------------------------------
3787      01/29/2008      1       3      0587
          01/30/2008                     0591
------------------------------------------------------

Just something to keep in mind.

<cfquery name="myQueryName" datasource="myDS">
    select myPackage.myFunction(myArg1, myArg2) response from dual
</cfquery>
<cfdump var="#myQueryName.response#">

• Model-Glue
• Transfer
• ColdSpring
• jQuery
• AjaxCFC
• Ext

I was actually amazed at myself when I realized this. I also found myself thinking that the saying “standing on the shoulders of giants” is appropriate in this situation. I created an absolutely amazing application, in less time than was anticipated, and with an slick, easy-to-use interface. If it wasn’t for the hard work of the Rineharts, Resigs, Corfields, Gondas, Mandels, and others of the world, my applications would still be grinding along on my homegrown frameworks that, while they work well, don’t have near the feature set of these libraries.

I’ll add voice to the thousands who say thank you for your hard work.

Powered by ScribeFire.

Go to Data & Services > Data Sources section of the ColdFusion Administrator and select “Other” from the type dropdown box.

JDBC URL: jdbc:mysql://{ip address of server}:3306/{name of database}
Driver Class: com.mysql.jdbc.Driver
Driver Name: MySQL Connector
Username: {DB username}
Password: {DB password}

That’s it. Really.

technorati tags:coldfusion, mysql