java.sql.SQLSyntaxErrorException：ORA-00936：缺少表达式

Question

I wrote a simple SQL query in Oracle which inserts some values.

But I got SQLSyntaxErrorException stating a "missing expression" error.

This my query:

String addManager = "INSERT INTO property_manager(EIN,NAME,HOME_PHONENUMBER,MOBILE_PHONENUMBER,EMAIL,PROPERTY_CIN)" +
       "VALUES (" + mein.getText() + ","  + mname.getText() +","+    mHome_phonenumber.getText() +","+ MMobile_phonenumber.getText()+"," + memail.getText() + ","+mproperty_cin.getText()+")";

Answer 1

The best solution is using a java.sql.PreparedStatement .

• It prevents SQL injection
• Escapes invalid characters in your Strings (such as ' ) and the characters which will break your query
• handles null and empty Strings
• Uses Oracle's query parsing cache (for better performance)
• Handles types such as Date and Blob much easier

Just google for java PreparedStatemnt and you see lots of samples.

Answer 2

You should put your values inside quotes.

String addManager = "INSERT INTO property_manager(EIN,NAME,HOME_PHONENUMBER,MOBILE_PHONENUMBER,EMAIL,PROPERTY_CIN)" +
   "VALUES ('" + mein.getText() + "','"  + mname.getText() +"','"+    mHome_phonenumber.getText() +"','"+ MMobile_phonenumber.getText()+"','" + memail.getText() + "','"+mproperty_cin.getText()+"')";

Or better yet, use parameters. Otherwise you risk sql injection attack.