java - 无法将屏幕值与 sql 表值进行比较

Question

我正在尝试将输入的屏幕值与数据库中存储的值进行比较。目前我正在尝试这段代码:

cell = sheet.getRow(i).getCell(2);
Class.forName("com.mysql.cj.jdbc.Driver");
Connection con = DriverManager.getConnection ("jdbc:mysql://madison-dev.czr6vej2htnn.us-east-1.rds.amazonaws.com:3306/madisondb","madisonadmin","t4xuw94$");// + "databasename=madison-dev.czr6vej2htnn.us-east-1.rds.amazonaws.com";
Statement st = con.createStatement();
ResultSet Rs = st.executeQuery("select name, zipcode, state, city, street from business_master where user_id =(\r\n" + 
    "select id\r\n" + 
    "from user_master\r\n" + 
    "where email = 'cell.getStringCellValue()') \r\n");

while (Rs.next()) {
    //  System.out.println(Rs.getString(1) + "  " + Rs.getString(2) + "  " + Rs.getString(3) + "  "
    //  + Rs.getString(4) + "  " + Rs.getString(5));
    System.out.println(Rs.getString(0));
}

屏幕没有显示任何值..当我尝试在循环之外打印 System.out.println(Rs.getString(3)) 时，它给了我一个错误

java.sql.SQLException: Illegal operation on empty result set.

Answer 1

您正在尝试查找电子邮件地址实际上是文本 'cell.getStringCellValue()' 而不是该方法返回的值的所有行。

当您编写查询字符串时，您可能会遭受 SQL 注入(inject)攻击。使用准备好的语句代替

PreparedStatement st = con.prepareStatement(
    "select name, zipcode, state, city, street from business_master where user_id =(" + 
    "select id " + 
    "from user_master " + 
    "where email = ?)");
st.setString(1, cell.getStringCellValue());
ResultSet Rs = st.executeQuery();