error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? or tel=?' at line 1

Question

Here's my query:

select *
from reg
where indexno=?
or tel=?

And here's my code:

Class.forName("com.mysql.cj.jdbc.Driver");
Connection con =DriverManager.getConnection("jdbc:mysql://url","unam","pass");
String query = "select * from reg where indexno= ? or tel=?";
PreparedStatement ps = con.prepareStatement(query);
ps.setString(1, in.getText());
ps.setString(2, tl.getText());
Statement st =  con.createStatement();
ResultSet rs = st.executeQuery(query);

Answer 1

Let's take a closer look at what your code is doing.

Connecting to the database:

Connection con =DriverManager.getConnection("jdbc:mysql://url","unam","pass");

Creating the SQL query:

String query = "select * from reg where indexno= ? or tel=?"`;

Creating a prepared statement:

PreparedStatement ps = con.prepareStatement(query);

Setting some bind parameter values:

ps.setString(1, in.getText());
ps.setString(2, tl.getText());

Creating a whole new non-prepared statement (wait, what? Why are we not using the prepared statement we spent some time creating?):

Statement st =  con.createStatement();

Using the new non-prepared statement to execute the SQL query.

ResultSet rs = st.executeQuery(query);

As a result of the last two lines, your SQL query is sent straight to the MySQL database. MySQL doesn't understand what the ? marks are for, and hence complains with a syntax error about them.

The ? marks are part of the JDBC standard, they are not understood by databases. When handling prepared statements, JDBC drivers will either replace the ? marks with the database's own syntax for bind parameters, or put the values directly in the SQL string after suitable escaping of any characters, before they send the SQL to the database. Statement s don't support bind parameters, and will just send the SQL string they are given straight to the database.

Your code creates a PreparedStatement and sets two bind parameter values. It seems a shame not to actually use your prepared statement once you've created it. You can get the result set you want out of it by calling ps.executeQuery() . There is no need for the separate Statement you created by calling connection.createStatement() .

The fix therefore is to remove the last two lines of the code in your question and add the following line in place of them:

ResultSet rs = ps.executeQuery();