unexpected token error while using update query in groovy - groovy

Question

I am trying to update the table with the query result using simple update query.
here is the query.
def restore(def id, def contentId) {
String hql = ""
def q = revisionService.getRevisionById(id)
hql = """UPDATE Content
SET
parentId = ${q.parent_id}
,user_id = ${q.user_id}
,inheritFromParent = ${q.inherit_from_parent}
,forceSSL = ${q.forcessl}
,title = ${q.title}
,fileName = ${q.file_name}
,fileNamePath = ${q.file_name_path}
,fileNameLookup = ${q.file_name_lookup}
,body = ${q.body}
,summary = ${q.summary}
,template = ${q.template}
,layout = ${q.layout}
,contentType = ${q.content_type}
,isNavItem = ${q.is_nav_item}
,navDepth = ${q.nav_depth}
,navOrder = ${q.nav_order}
,metaTitle = ${q.meta_title}
,metaKeywords = ${q.meta_keywords}
,metaDescription = ${q.meta_description}
,isActive = ${q.is_active}
,col1 = ${q.col1}
,col2 = ${q.col2}
,col3 = ${q.col3}
,col4 = ${q.col4}
,col5 = ${q.col5}
,col6 = ${q.col6}
,col7 = ${q.col7}
,col8 = ${q.col8}
,col9 = ${q.col9}
WHERE id = ${contentId}"""
try {
Content.executeUpdate(hql)
} catch(Exception e) {
println e
}
}
when i execute this query getting an exception saying org.springframework.orm.hibernate4.HibernateQueryException: unexpected token: about near line 7, column 50.
here is stacktrace from my terminal.
line 7:50: unexpected token: about
Message: unexpected token: about
Line | Method
->> 353 | $tt__restore in org.regionscms.ContentService$$EOqIswWO
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| 48 | restore in org.regionscms.ContentController
| 198 | doFilter . . in grails.plugin.cache.web.filter.PageFragmentCachingFilter
| 63 | doFilter in grails.plugin.cache.web.filter.AbstractFilter
| 53 | doFilter . . in grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter
| 49 | doFilter in grails.plugin.springsecurity.web.authentication.RequestHolderAuthenticationFilter
| 82 | doFilter . . in grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter
| 1145 | runWorker in java.util.concurrent.ThreadPoolExecutor
| 615 | run . . . . in java.util.concurrent.ThreadPoolExecutor$Worker
^ 745 | run in java.lang.Thread
org.springframework.orm.hibernate4.HibernateQueryException: unexpected token: about near line 7, column 50 [UPDATE org.regionscms.Content
SET
parentId = 1
,user_id = 1
,inheritFromParent = true
,forceSSL = false
,title = about us
,fileName = about-us
,fileNamePath = home/about-us
,fileNameLookup = 72635069142711694
,body = tests
,summary = tests
,template = index.gsp
,layout = Main
,contentType = Page
,isNavItem = true
,navDepth = 1
,navOrder = 2
,metaTitle = null
,metaKeywords = null
,metaDescription = null
,isActive = true
,col1 = 1045719790170831251
,col2 = 72635069142711694
,col3 = 0
,col4 = 0
,col5 = 0
,col6 = 0
,col7 = 0
,col8 = 0
,col9 = 0
WHERE id = 2]; nested exception is org.hibernate.hql.internal.ast.QuerySyntaxException: unexpected token: about near line 7, column 50 [UPDATE org.regionscms.Content
SET
parentId = 1
,user_id = 1
,inheritFromParent = true
,forceSSL = false
,title = about us
,fileName = about-us
,fileNamePath = home/about-us
,fileNameLookup = 72635069142711694
,body = tests
,summary = tests
,template = index.gsp
,layout = Main
,contentType = Page
,isNavItem = true
,navDepth = 1
,navOrder = 2
,metaTitle = null
,metaKeywords = null
,metaDescription = null
,isActive = true
,col1 = 1045719790170831251
,col2 = 72635069142711694
,col3 = 0
,col4 = 0
,col5 = 0
,col6 = 0
,col7 = 0
,col8 = 0
,col9 = 0
WHERE id = 2]

Answer 1

see the manual for executeUpdate how to properly use a param map like this:
Content.executeUpdate("UPDATE Content c SET parentId = :parentId, ... WHERE id = :contentId",
[cotentId: contentId, parentId: q.parentId, ...])
Code like yours is basically the road to SQL-Injection. The problem here is the use of GString replacements, which leads to invalid SQL (it should be 'about us' and not about us)