DataObjectUtils class provides an important and easy to use facility to obtain a primary key value from a DataObject and to locate a DataObject in the database for a known primary key. Both operations work in a generic fashion and do not require primary key to be an object property.

| Security Warning DataObjectUtils make it very easy to use a primary key value as a universal "code" for an object in web forms and URLs. This opens a potential security hole in the interface. If application code is not careful enough, a malicious user can gain access to the information she is not allowed to see (e.g. other people's accounts) simply by trying a series of sequential numbers. So, for example, it is probably okay to use product PK to build a bookmarkable link to a catalog product, but it may not be appropriate to do that for a private user profile record.

DataObjectUtils API is really straightforward and self-explanatory. It supports the most common case of a single column integer primary key, but also a more generic case of an arbitrary PK (that can also be compound, i.e. consist of more than one column). Here is an example:

    // obtain PK to build a bookmarkable artist page URL
    Artist artist = ...;
    int artistID = DataObjectUtils.intPKForObject(artist);
    String artistURL = "http://www.example.org/catalogapp/artists?a=" + artistID;

    // find an artist from URL parameters
    HttpServletRequest request = ...;
    DataContext context = ...;
    String idString = request.getParameter("a");

    if(idString != null) {
      Artist artist = DataObjectUtils.objectForPK(context, Artist.class, Integer.parseInt(idString));
    }