Java mysql语法错误

Question

I get syntax error to mysql insert statement. May I know how to correct this error ?

user=txtuser.getText();
      char[] pass=jPasswordField1.getPassword();
             String passString=new String(pass);
            try{                
                Connection con = createConnection();               
                Statement st = con.createStatement();


**String sql = "INSERT INTO login(username,Password)"+"VALUES"+"('"user"','"passString"')";**
 st.executeUpdate(sql);
            }
            catch(Exception e){
                JOptionPane.showMessageDialog(null,"Exception: "+ e.toString());
            }

Answer 1

You're missing a few + operators:

String sql = "INSERT INTO login(username,Password) VALUES ('" + user + "','" + passString + "')";

Consider using PreparedStatement placeholders to set these parameters. This will protect you from SQL injection attacks also. Here is an example