Java MySql prepareStatement

Question

Hey I have problem with preparedStatement, I want to find min for few columns, I'm iterating over the names of columns and inserting them inside my preparedStatement like that

connection.prepareStatement("SELECT min( ? ) as min FROM test");
minStatement.setString(1, "some_column");

and when retrieving from ResultSet I'm getting the column name, in this case the result is "some_column" and should be 0. When using normal statement it does return right value. I have no idea what I'm doing wrong. Thanks for any help.

Answer 1

You cannot specify a column name in prepared statement like this, what you get is:

SELECT MIN('some_column') AS min FROM test

Instead of:

SELECT MIN(some_column) AS min FROM test

So, your query selects the minimal value 'some_column' ... which is 'some_column' .

You could, instead, try that:

connection.prepareStatement("SELECT min(" + some_column + " ) as min FROM test");

But this may lead to injection attacks.