Java + JDBC：预处理语句失败

Question

I'm trying to make a prepared statement and the drivers are working how I assume they are supposed to but the only problem is that my query is no longer valid.

I'm trying to write this query:

SELECT ip_address
FROM log_activity
WHERE created_at
  BETWEEN "2017-01-01 00:00:00"
  AND DATE_ADD("2017-01-01 00:00:00", INTERVAL 1 HOUR)
GROUP BY ip_address
HAVING COUNT(*) > 200;

But after inserting the parameters for the prepared statement it comes out as:

SELECT ip_address
FROM log_activity
WHERE created_at
  BETWEEN '\'2017-01-01 00:00:00\''
  AND DATE_ADD('\'2017-01-01 00:00:00\'', INTERVAL 1 'hour')
GROUP BY ip_address
HAVING COUNT(*) > 200;

Which is no longer valid SQL. So how do I remove these quotations from the parameters or what is a good way to work around this?

...

String startDateArg = "'" + args[0].split("=", 2)[1].replace(".", " ") + "'";
String durationArg = args[1].split("=", 2)[1];
int thresholdArg = Integer.parseInt(args[2].split("=", 2)[1]);

String duration = durationArg.equals("hourly") ? "hour" : durationArg.equals("daily") ? "day" : null;

String getUsersOverAPILimitQuery = "" +
    "select ip_address " +
    "from log_activity " +
    "where created_at " +
    "  between ?" +
    "  and date_add(?, interval 1 ?) " +
    "group by ip_address " +
    "having count(*) > ?;";
PreparedStatement preparedStatement = con.prepareStatement(getUsersOverAPILimitQuery);
preparedStatement.setString(1, startDateArg);
preparedStatement.setString(2, startDateArg);
preparedStatement.setString(3, duration);
preparedStatement.setInt(4, thresholdArg);

System.out.println(preparedStatement);

ResultSet getUsersOverAPILimit = preparedStatement.executeQuery();

while (getUsersOverAPILimit.next()) {
    String ip_address = getUsersOverAPILimit.getString("ip_address");
    System.out.println(ip_address);
}

...

Answer 1

Instead of this:

String startDateArg = "'" + args[0].split("=", 2)[1].replace(".", " ") + "'";

Do this:

String startDateArg = args[0].split("=", 2)[1].replace(".", " ");

no need to add in the single quotes, the preparedstatement does it for you.