java - JAVA中SQL语句的where子句中使用变量

Question

我想根据变量(supp_rec 数组)中存储的值从数据库中选择一些行。我在之前类似的帖子/问题中使用过提示。但是，我仍然收到一些错误消息。代码片段如下:

waiting_time = dbMngr.runQuery( "SELECT " + "ExpectedWaitingTime" + " FROM Student" +     "where deptID = '" + supp_rec[1] + "' and weight = '" + supp_rec[2] + "'");
prob = PoisonModel(Phase3GUI.existence_time -     Long.parseLong(waiting_time[0]),2,Phase3GUI.existence_time);
if (prob > 0.5)
 {
    dbMngr.execUpdate( "DELETE " + " FROM Student" + "where deptID NOT IN" + supp_rec[1] + " and weight NOT IN" + supp_rec[2]);
 }+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

错误信息如下:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'deptID NOT IN1 and weight NOT IN8' at line 1 at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '= '1' and weight = '8'' at line 1
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

如果您能提供有关如何解决这些错误的帮助，我将不胜感激。谢谢。

Answer 1

在变量内容之间添加了 ()，它们之间有空格，并进行了一些格式化

dbMngr.execUpdate(String.format("DELETE FROM Student WHERE deptID NOT IN (%s) and weight NOT IN (%s)", supp_rec[1], supp_rec[2]));

此外，不使用针对 SQL Injections 的保护措施对您来说风险很高。