title: Query with dynamic schema without using string concatenation
body: <p>I have a system that uses a Oracle database, with a schema that is different from the application user. The schema name itself is not known in advance, so we can't just hardcode it. It's a system property.</p>
  
  <p>Most of the data access is through Hibernate, which can specify the default schema on connection so this is not a problem in those cases.</p>
  
  <p>However, there are a few places where plain SQL queries are used (using spring jdbcTemplate). So right now we have something that boils down to:</p>
  
  <pre><code>Map&lt;String,Object&gt; result = jdbcTemplate.queryForMap("SELECT A, B, C FROM "+schema+".TABLE WHERE blablablah");
  </code></pre>
  
  <p>And this, of course, is an open SQL injection vulnerability. We're planning security audits and this will be flagged for sure. </p>
  
  <p>So the question is: How do I specify the schema on the query, be it with jdbcTemplate, another Sprint data access utility, or even plain jdbc? </p>
  
  <p>Thank you,
  JGN</p>