IBatis2 dynamic update queries execution - sql

Question

I am working on executing a set of update queries which are dynamically generated to be executed on SQL Server using iBatis2. I have written update element in sqlMap as below which executes within scope of a transaction :
<update id="updateDepartments" parameterClass="Office">
declare #sql nvarchar(400);
<iterate property="departmentList">
<!-- form the update query and store in #sql-->
exec sp_executesql #sql
</iterate>
</update>
I have a couple of questions related to the way above queries execute.
Do they execute as a batch or individually i.e. does the number of network calls to database server are equal to the number of update queries generated ?
How can the client code know how many rows actually got updated if the queries execute ? The return value shows as 1 always even though multiple rows got updated.
Is there a better way to do this using iBatis2 ?
Example of Dynamic update queries formed are:
update Department set cost1=1000 where department_name='sales'
update Department set cost2=2000 where department_name='finance'
update Department set cost3=3000 where department_name='marketing'
Parameters passed as part of paramterClass are List of objects containing:
1. Department name
2. Column name to be updated
3. Value to be updated for column in 2.
example,
['sales', 'cost1', 1000]
['finance', 'cost2', 2000]

Answer 1

It may be possible to perform this as a batch execution but I'm not positive it can be. I haven't used iBatis 2 in a long time now.
What I'm sure will work is executing each SQL statement separately. There's pretty much no overhead in calling it multiple times, unless you are performing thousands of updates at once. Are you?
I think you could call is each time using a parameter class like:
class updateDptParams {
String name;
String column;
String value;
// setters & getters omitted for brevity
}
Then, the mapper could look like:
<update id="updateDepartment" parameterClass="updateDptParams">
update Department set ${column}=${value} where department_name=#{name}
</update>
Note that column and value are injected as strings (using ${}), since they are supposed to have variable types. However, name is a standard iBatis JDBC parameter (using #{}) since it's always a VARCHAR. Make sure injected parameters come from a known source, and not from the user interface or other external source; otherwise your code will be vulnerable to SQL Injection.
Finally, if you are updating thousands of rows, this solution can still be good. It could be improved batching updates, or performing multiple updates at once using complex SQL statements. I'm not sure how easy or error-prone this potential optimization could be, though.