无论如何，是否要使用来自2个不同表的2个不同外键将数据插入表中？

Question

I have trouble when inserting data from jsp to database. I have 3 tables:

Books(bookid), Users(id), Review(b_id,u_id) , foreign key b_id, u_id references to 2 table above. Here is my code so far:

java

public void insert(ReviewModel model) {
    try {
        String b_id = null;
        String u_id = null;
        String sql = "insert into review (content,datePost,rating,b_id,u_id)\n"
                + "values (?,?,?,(select BookID from Books where BookID = '" + b_id + "'),(select id from Users where id  = '" + u_id + "') )";
        PreparedStatement statement = connection.prepareCall(sql);
        statement.setString(1, model.getContent());
        statement.setDate(2, (Date) (model.getDatePost()));
        statement.setFloat(3, model.getRating());
        statement.setInt(4, model.getBookid());
        statement.setInt(5, model.getUserid());
        statement.executeUpdate();
    } catch (SQLException ex) {
        Logger.getLogger(ReviewDAO.class.getName()).log(Level.SEVERE, null, ex);
    }
}

Answer 1

The problem lies here:

"...where BookID = '" + b_id + "')..."

statement.setInt(4, model.getBookid());
statement.setInt(5, model.getUserid());

The number of set parameters and the question marks must match. You try to bind it as a named parameter, however in your sql you just concat a null string to it. So either remove the parameter setter lines above and fill up the string variables like

String b_id=mode.getBookId()

or use placeholder of '?' : ... where BookID = ? ... ... where BookID = ? ...

(use the latter one, the first one is vulnerable to sql injection)