sql准备语句和java

Question

I am using a Prepared statement which works fine eg if I run

Select * from users where name = 'john' and sName = sName

I get a list of everyone whose name is john. However if I execute the query

Select * from users where name= ? and sName = ?

the query doesn't return anything, I think it is because it adds the '' to the string being passed?

//n value is passed through GUI interface.
String s = "sName";
PreparedStatement prep = "Select * from users where name= ? and sName= ?";
prep.setString(1, n);
prep.setString(2, s);

Thanks for your help

Answer 1

You are doing it wrong. You must first create a variable of PreparedStatement and initialize it with the query then execute it using executeQuery() method of PreparedStatement .

It would look like ...

String s = "surname";
    String query = "Select * from users where name= ? and surname = ?";
    PreparedStatement prep = connection.prepareStatement(query);
    prep.setString(1, n);
    prep.setString(2, s);
    ResultSet rs = prep.executeQuery();

Answer 2

First, note that in

Select * from users where name = 'john' and sName = sName

sName=sName just do nothing if sName is a column name or does not work.

Then, when you have a statement

Select * from users where name= ? and surname = ?

You have to set both parameters with PreparedStatement#setXxx() methods. Since you set the 2d parameter with String s = "surname" , you will fetch all users that have a surname value which is the string "surname" , and what ever name you set in the first parameter. It looks unlikely, and this is why you get no result.

Note1: with this statement you cannot fetch users based only on their name. You have to define another statement, eg

Select * from users where name= ?

Note2: if you have users in the database, without a surname, ie the surname value is NULL , then you can use the first statement with

// n variable contains the name
String query = "Select * from users where name= ? and surname = ?";
PreparedStatement prep = connection.prepareStatement(query);
prep.setString(1, n);
prep.setNull(2, Types.VARCHAR);
ResultSet rs = prep.executeQuery();

Answer 3

使用 executeQuery() 而不是 execute()