java - Mysql Java 更新查询

Question

我有一个监听器，它监听按钮并从输入中获取 3 个文本字段来执行更新查询。我想执行更新，但在查询中传递我的本地变量(姓名、城市、薪水)。我能做什么？

public void actionPerformed(ActionEvent arg0) {
        final String name;
        final String city;
        final String salary; 

        name = (textFieldName.getText());   
        city = (textFieldCity.getText());   
        salary = (textFieldSalary.getText());   

        System.out.println(salary);
        try {
                Statement s = connection.createStatement();
                s.executeUpdate("INSERT INTO users (name,city,salary) VALUES (name, city,salary)");

Answer 1

我会选择PreparedStatement

PreparedStatement s = connection.prepareStatement("INSERT INTO users (name,city,salary) VALUES (?, ?, ?)");
s.setString(1, name);
s.setString(2, city);
s.setString(3, salary);
boolean res = s.execute();

这种方法更好一点，引用会被自动管理，并且会防止简单的 SQL 注入(inject)。