JDBC-如何插入字符串值

Question

When trying to insert the value of a string into my db using JDBC instead of inserting the String's value it inserts the String's name.

I have a string named firstName, the value of this string is given by user input.

Here is my sql statement:

String sql = "Insert INTO users (ID, firstName, address) VALUES ('124','+firstName()','123')";

Answer 1

For various reasons, it is better to use java.sql.PreparedStatement . to execute statements with parameters. For example, if you want to avoid sql injection attacks.

See the examples in Using Prepared Statements from The Java Tutorials .

The advantage of using SQL statements that take parameters is that you can use the same statement and supply it with different values each time you execute it.

PreparedStatement pstmt = conn.prepareStatement(
   "UPDATE EMPLOYEES SET FIRST_NAME= ? WHERE ID = ?");

pstmt.setString(1, "user1080390"); // set parameter 1 (FIRST_NAME)
pstmt.setInt(2, 101); // set parameter 2 (ID)

int rows = pstmt.executeUpdate(); // "rows" save the affected rows

Answer 2

Try this

String sql = "Insert INTO users (ID, firstName, address) VALUES ('124','"+firstName()+"','123')";

To prevent sql injections, you need to escape the string before using in a query or try the prepared statements.

Answer 3

Something like this..

String firstName ="sample";
String sql = "Insert INTO users (ID, firstName, address) VALUES ('124',"+firstName+",'123')";