在JAVA中使用SQL语句的where子句中的变量

Question

I want to select some rows from my database based on the values stored in my variables ( supp_rec array). I have used tips on similar previous post/question. However, I am still having some error messages. The code snippet is below:

waiting_time = dbMngr.runQuery( "SELECT " + "ExpectedWaitingTime" + " FROM Student" +     "where deptID = '" + supp_rec[1] + "' and weight = '" + supp_rec[2] + "'");
prob = PoisonModel(Phase3GUI.existence_time -     Long.parseLong(waiting_time[0]),2,Phase3GUI.existence_time);
if (prob > 0.5)
 {
    dbMngr.execUpdate( "DELETE " + " FROM Student" + "where deptID NOT IN" + supp_rec[1] + " and weight NOT IN" + supp_rec[2]);
 }+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

The error message is below:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'deptID NOT IN1 and weight NOT IN8' at line 1 at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= '1' and weight = '8'' at line 1
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

Please I will appreciate any help on how to solve these errors. Thank you.

Answer 1

The mysql error message is

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'deptID NOT IN1 and weight NOT IN8 ' at line 1 at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

So, without the space, mysql tries to parse IN1 as a part of it's syntax & hence the query fails. It should be IN 1 where IN is valid SQL token.

To correct this, add a space after IN in your statement -

dbMngr.execUpdate( "DELETE " + " FROM Student" + "where deptID NOT IN " + supp_rec[1] + " and weight NOT IN " + supp_rec[2]);

EDIT : Noticed that you're passing a single value for NOT IN . In that case, it should be just != operator.

dbMngr.execUpdate( "DELETE " + " FROM Student" + "where deptID != " + supp_rec[1] + " and weight != " + supp_rec[2]);

Answer 2

Added () between the variables content, spaces between them and formatted a little bit

dbMngr.execUpdate(String.format("DELETE FROM Student WHERE deptID NOT IN (%s) and weight NOT IN (%s)", supp_rec[1], supp_rec[2]));

Additionally , It's highly risky for you, not be using protections against SQL Injections

Answer 3

You should really use a PreparedStatement. The SQL will be much easier to read and you'll avoid most of these problems.