ORA-00917：逗号缺失-插入查询失败

Question

I'm trying to create insert query in JSP page as follows

    try 
    {
        Class.forName("oracle.jdbc.driver.OracleDriver");
    } 
    catch (ClassNotFoundException e) 
    {
        e.printStackTrace();
    }

    try 
    {
        connection = DriverManager.getConnection(
        "jdbc:oracle:thin:@localhost:1521:" + "XE", "hr","hr");

        if (connection != null) 
        {
            statement = connection.createStatement();

            String q2 = "INSERT INTO HR.tweets (";
            q2 = q2 + "DATE_TIME,USER_NAME,TWEET_BEFORE,TWEET_AFTER)";
            q2 = q2 + "VALUES (";
            q2 = q2 + "(select SYSDATE from dual),";
            q2 = q2 + "'" + tweet.getUser().getScreenName() + "'" + ",";
            q2 = q2 + "'" + tweet.getText() + "'" +",";
            q2 = q2 + "'" + finalstring + "')";

            statement.execute(q2);   
            statement.close();
            connection.close();
        }
    } 
    catch (SQLException e) 
    {
    e.printStackTrace();
    } 

At statement.execute(q2) I'm getting ORA-00917: missing comma error .

The following query is created in a code :

INSERT INTO HR.tweets (DATE_TIME,USER_NAME,TWEET_BEFORE,TWEET_AFTER)VALUES ((select SYSDATE from dual),'Dannazxcv','RT @HugotInhinyero: Wish we could turn back time to the good old days. When our mama sings us to sleep but now we're stressed out.🎶🎶
#engin…','hugotinhinyero turn back time good days. mama sing sleep we're stress out.   engin'  )

Please help me.

Answer 1

Your SQL insert has an syntax error since one of your parameters contains a ' :

'hugotinhinyero turn back time good days. mama sing sleep we're stress out. engin'

To avoid this kind of errors, don't build SQL strings manually, but use a PreparedStatement and parameters instead:

String insert = "INSERT INTO HR.tweets (DATE_TIME,USER_NAME,TWEET_BEFORE,TWEET_AFTER) " + 
" VALUES ((select SYSDATE from dual),?,?,?)";
PreparedStatement stmt = connection.prepareStatement(insert);
stmt.setParameter(1, tweet.getUser().getScreenName());
stmt.setParameter(2, tweet.getText());
stmt.setParameter(3, finalstring);
stmt.executUpdate();

Answer 2

The problem here is that you are using special characters, which causes the statement sent through to the database to be invalid.

Try using a prepared statement like this...

PreparedStatement pstatement = null;
Connection connection = null;
    try 
    {

        connection = DriverManager.getConnection(
        "jdbc:oracle:thin:@localhost:1521:" + "XE", "hr","hr");

        if (connection != null) 
        {
            pstatement = connection.prepareStatement("INSERT INTO HR.tweets (DATE_TIME,USER_NAME,TWEET_BEFORE,TWEET_AFTER) VALUES ((select SYSDATE from dual),?,?,?)");


            q2 = q2 + "'" + tweet.getUser().getScreenName() + "'" + ",";
            q2 = q2 + "'" + tweet.getText() + "'" +",";
            q2 = q2 + "'" + finalstring + "')";
            pstatement.setString(1, tweet.getUser().getScreenName());
            pstatement.setString(2,tweet.getText());
            pstatement.setString(3, finalstring);
            pstatement.execute();   

        }
    } 
    catch (SQLException e) 
    {
       e.printStackTrace();
    }finally{
        pstatement.close();
        connection.close();
    }

...prepared statements usually take care of malformed strings and invalid quotes sent to the DB.

Answer 3

Use PreparedStatement instead of Statement .
Your query will always fail if any of your field will contain quote character ( ' ).
Besides, your query is vulnerable to SQL injection attack, while PreparedStatement guards against a such attack.

Details on PreparedStatement can be found in this tutorial:
http://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html
This is a very very basic knowledge so I dont't explain it here.

Answer 4

As mentioned by @wero, the issue with the query is that it contains a quote ('). To escape it you can use a backslash (\\).

Eg: we\'re

However like other's have suggested, its safer to use prepared-statements which also take care of guarding against sql-injection as a bonus !