Java-如何使用string.format（）替换Sql语句创建过程中的任何字符串连接？

Question

我将如何使用string.format（）在此Java / SQL代码中省略+字符串串联+。

String sql = "SELECT * FROM "+p_tableName+" WHERE 1 = 0";

Answer 1

String sql = String.format("SELECT * FROM %s WHERE 1 = 0", p_tableName);

这样制作SQL语句时请务必小心，因为它们很容易在SQL注入攻击中对您使用。

Answer 2

You can use String.format("SELECT * FROM %s WHERE 1 = 0", table_name) . But, I strongly advise you to use PreparedStatement instead (See How do I make a prepared statement? , https://stackoverflow.com/a/396765/130224 , PreparedStatements and performance , and Using Prepared Statements ). PreparedStatement yields higher performance and security.