mysql中带有preparedstatement的查询中的问题

Question

in query "_latin" is getting concatenated before every param

java code :

        PreparedStatement prepStmt = null;
        QueryString = "SELECT FROM Student WHERE username=? AND password=? ";
        prepStmt=con.prepareStatement(QueryString);
        prepStmt.setString(1,un);
        prepStmt.setString(2,pwd);
        ResultSet rs;

        System.out.println(prepStmt);
       rs = prepStmt.executeQuery();

error :

java.sql.SQLException: [MySQL][ODBC 5.1 Driver][mysqld-5.5.24-log]You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FROM Student WHERE username=_latin1'wow' AND password=_latin1'hell'' at line 1

why its happening , whats the solution

and this is table :

Answer 1

You are missing the column list from your query. You have to either specify explicitly the columns you want, or retrieve all via wildcard. Instead of:

SELECT FROM Student WHERE username = ? AND password = ?

You want something like:

SELECT * FROM Student WHERE username = ? AND password = ?

Note that its almost always better to explicitly define the columns you want to retrieve, rather than using the wildcard expression.