提供参数时查询不起作用

Question

This Works just fine

conn = DatabaseConnection.getConnection();
stmt = conn.prepareStatement("SELECT * FROM Persons ORDER by firstName Desc");
rs = stmt.executeQuery();

But this one doesn't work

conn = DatabaseConnection.getConnection();
stmt = conn.prepareStatement("SELECT * FROM Persons ORDER by ? ?");
stmt.setString(1, "firstName");
stmt.setString(2, "Desc");
rs = stmt.executeQuery();

Not sure why this would not work. Both my parameters are variables and that's the reason I would want to set it explicitly.

Answer 1

Placeholders (?) in prepared statements are used for column replacement. You cannot set the 'DESC' attribute of ORDER BY using setString method.

From PreparedStatement setString javadocs :

  * Sets the designated parameter to the given Java <code>String</code> value. * The driver converts this * to an SQL <code>VARCHAR</code> or <code>LONGVARCHAR</code> value * (depending on the argument's * size relative to the driver's limits on <code>VARCHAR</code> values) * when it sends it to the database. 

In case you want to take the ORDER as a parameter to your DAO method then simply use String replacement in the query. Maybe like this:

public myDAOMethod(String firstName, String order) {

    String query = "SELECT * FROM Persons ORDER by ? " + order;
    conn = DatabaseConnection.getConnection(query);
    stmt = conn.prepareStatement();
    stmt.setString(1, "firstName");
    rs = stmt.executeQuery();

}

Answer 2

Actually your query converted into something like in case of prepared statement:

SELECT * FROM Persons ORDER by 'firstname' 'Desc'

This behaviour provides protection against SQL injection.