要删除的正确SQL语法是什么？

Question

I'm making a simple board. I want to delete an article to connect in DB one access after the user has input password.

So, I made a method in a DAO class. This is the query part.

        sql.append("DELETE FROM article ");
        sql.append("WHERE ? = (SELECT pwd FROM article WHERE no = ?) and no = ?");
        pstmt = conn.prepareStatement(sql.toString());
        pstmt.setString(1, pwd);
        pstmt.setInt(2, no);
        pstmt.setInt(3, no);

Someone told me it is incorrect syntax. But, it is working.

Is it incorrect syntax?

Answer 1

I think you have unnecessary subqueries in your statement. Why don't you simplify your query:

sql.append("DELETE FROM article WHERE no = ?");
pstmt = conn.prepareStatement(sql.toString());
pstmt.setInt(1, no);

Answer 2

Q: Is it incorrect syntax?

The syntax of the SQL DELETE statement looks valid. There's nothing "incorrect" about the syntax, in terms of it being a valid SQL statement to prepare and execute.

---

However, it does look like the subquery is not necessary. I believe an equivalent result could be achieved without a subquery. We would tend to write a simpler statement, without the subquery. But that doesn't make the syntax of your statement "incorrect".

What we don't see is the reasoning for including the subquery. Why wouldn't this statement achieve an equivalent result?

   DELETE FROM article WHERE pwd = ? AND no = ?

Most (all?) relational databases are going to throw an error if (when) the subquery returns more than one row. (We don't see any guarantee that no is unique in the article table.)

If the value in the pwd column is NULL, then the equality comparison " pwd = ? " in the WHERE clause is going to evaluate to NULL. So it's not possible for this statement to delete a row that has a NULL value for pwd . (The statement would need to be modified to allow deletion of rows with NULL values for pwd column.)

We don't see any Java code that initializes sql . We're going to assume that there's a previous line that sets the contents of sql to a zero length string, or whitespace and/or valid SQL comment. Why not just

  sql = "DELETE FROM article"
        + " WHERE pwd = ?"
        + " AND no = ?";

On a style note, when I'm dynamically generating a statement, appending additional SQL syntax to an existing string, I tend to include the whitespace at the beginning of the string I'm adding, not at the end of what I'm going to add to.

---

If the pwd column is a "password", we're assuming that what's being stored is a hashed value, and not plaintext.

And we're assuming that this block is within a "try/catch/finally" block.

We can have some quibbles with the code.

But as far as the syntax of the SQL DELETE statement, it looks valid to me.