无法从 MySQL 数据库中删除记录

Question

Trying to delete record from my database, but I get the error "Unknown column '' in 'where clause'".

private void deleteUser() {
    String query = "DELETE FROM user WHERE Name =" + tfemail.getText() + "";
    executeQuery(query);
    showUsers();
}

Answer 1

You can't write queries this way. Imagine someone put in the tfemail field this text:

"Joe' OR FALSE"

and let's see what that would do to your SQL query:

DELETE FROM user WHERE Name = 'Joe' OR FALSE;

bye, database!

Some dbs let you execute stuff on the server the db engine runs on. Which means this trick can be used to completely hack the machine or format the disk entirely. bye, entire machine.

This also means your executeQuery method needs to be removed - that abstraction ('here is some SQL, please run it') is rarely useful (as it cannot contain any user input), and entices you to write security leaks.

The solution is prepared statements:

PreparedStatement ps = con.prepareStatement("DELETE FROM user WHERE Name = ?");
ps.setString(1, "Joe");
ps.executeUpdate();

This solves your problem, and does so safely - ps.setString(1, "Joe' OR FALSE"); is now no longer an issue (the DB engine or JDBC driver guarantees that it will take care of the problem; the effect would be to delete the entry in your user table that literally reads "Joe' OR FALSE").

Furthermore, storing passwords in a database is not an acceptable strategy; the solution is eg bcrypt: Use a hashing algorithm designed specifically to store passwords.

Answer 2

String query = "DELETE FROM user WHERE Name ='" + tfemail.getText() + "'"; ^ ^ |___________add___________|