Java Sql更新语句。 处理引号中的空值

Question

I have a java program executing a SQL UPDATE to a table:

 String qry = "UPDATE [Artists] SET [Website] = '" + artist.getWebsite() + "' WHERE [ID] = " + artist.getID() + "'";

If artist.getWebsite() is null it is inserting the string 'null' because of the quotes when I want to just leave it as a SQL NULL. But I need the quotes as most of the time artist.getWebsite() returns a string. What is the easiest way of dealing with this?

Answer 1

Don't. Use. String. Concatenation. To. Build. SQL. Statements. There are several reasons for this, not least this one:

...and nulls are one of those reasons. More: http://bobby-tables.com It's also really easy to get confused when doing it (your example has an extra ' at the end, for instance).

Let's ignore null for a moment: What if the value you're putting in the string contains ' ? Now you have a broken SQL string.

Instead, use a PreparedStatement :

PreparedStatement ps = conn.prepareStatement(
   "UPDATE [Artists] SET [Website] = ? WHERE [ID] = ?"
);
ps.setString(1, artist.getWebsite());
ps.setInt(2), artist.getID());

Note that there are no quotes around the ? where we're going to put the string; PreparedStatement handles correctly quoting and escaping the content for you.

I think setString lets you set null s, but I haven't done JDBC stuff in a while. For non-String columns, you'd use setNull ; you may need a branch if setString isn't happy to do it, eg:

PreparedStatement ps = conn.prepareStatement(
   "UPDATE [Artists] SET [Website] = ? WHERE [ID] = ?"
);
String web = artist.getWebsite();
if (web == null) {
    ps.setNull(1, JDBCType.NVARCHAR);
} else {
    ps.setString(1, web);
}
ps.setInt(2), artist.getID());

...but give setString a go first.

Answer 2

Use ..NULLIF('" + artist.getWebsite() + "', ''NULL''... when doing and update. More about operator: https://msdn.microsoft.com/en-us/library/ms177562.aspx

This would return actual NULL

SELECT NULLIF('NULL', 'NULL')

Answer 3

If you use JDBC you should always try to use prepared statements instead of just concatenating the statement manually. In particular, using the setNull() method on the prepared statement will insert a SQL NULL into the query.

Using prepared statements also helps you protect your application from SQL injection attacks.

Please see the following link: http://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html