java - 如何将变量传递到 SQL 查询中

Question

我将一个字符串从一个场景传递到另一个场景，两者在 JavaFX 中都使用不同的 Controller ，并使用该字符串执行 sql 语句，但出现“检查与 maria DB 服务器对应的手册”的错误。我会把相关代码写下来。任何帮助，将不胜感激。menu.fxml ----> MenuController.java AND orderList.fxml ----> OrderListController.java

                FXMLLoader loader = new FXMLLoader(getClass().getResource("orderList.fxml"));
                Parent root = loader.load();
                OrderListController orderListController = loader.getController();
                orderListController.transferMessage(orderRefNo);
                Stage orderListStage = new Stage();
                orderListStage.setScene(new Scene(root));
                orderListStage.show();

public class OrderListController implements Initializable {

    private String orderRefNo;
    public void transferMessage(String message){
        orderRefNo = message;
    }

    public OrderListController() throws SQLException, ClassNotFoundException {
    }
    @Override
    public void initialize(URL location, ResourceBundle resources) {
        try {
            //ResultSet resultSet = connection.createStatement().executeQuery("SELECT * FROM "+orderRefNo+"");
            PreparedStatement preparedStatement = connection.prepareStatement("SELECT * FROM ?");
            preparedStatement.setString(1, orderRefNo);
            ResultSet resultSet = preparedStatement.executeQuery();
            while (resultSet.next()){
                observableList.add(new orderListTableModel(resultSet.getString("ID"), resultSet.getString("FOOD_NAME"), resultSet.getString("QUANTITY"),
                        resultSet.getString("PRICE")));
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }

        id_OrderListTableModel.setCellValueFactory(new PropertyValueFactory<>("id"));
        food_OrderListTableModel.setCellValueFactory(new PropertyValueFactory<>("foodName"));
        quantity_OrderListTableModel.setCellValueFactory(new PropertyValueFactory<>("qty"));
        price_OrderListTableModel.setCellValueFactory(new PropertyValueFactory<>("price"));

        orderListTableModel.setItems(null);
        orderListTableModel.setItems(observableList);
    }
}

错误代码

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'null' at line 1
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:488)
    at com.mysql.jdbc.Util.handleNewInstance(Util.java:425)
    at com.mysql.jdbc.Util.getInstance(Util.java:408)
    at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:944)
    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3978)
    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3914)
    at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:2530)
    at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2683)
    at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2495)
    at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:1903)
    at com.mysql.jdbc.PreparedStatement.executeQuery(PreparedStatement.java:2011)
    at sample.OrderListController.initialize(OrderListController.java:37)
    at javafx.fxml/javafx.fxml.FXMLLoader.loadImpl(FXMLLoader.java:2573)
    at javafx.fxml/javafx.fxml.FXMLLoader.loadImpl(FXMLLoader.java:2466)
    at javafx.fxml/javafx.fxml.FXMLLoader.load(FXMLLoader.java:2435)
    at sample.MenuController.menuBtnClicked(MenuController.java:107)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:564)
    at com.sun.javafx.reflect.Trampoline.invoke(MethodUtil.java:76)
    at jdk.internal.reflect.GeneratedMethodAccessor2.invoke(Unknown Source)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.base/java.lang.reflect.Method.invoke(Method.java:564)
    at javafx.base/com.sun.javafx.reflect.MethodUtil.invoke(MethodUtil.java:275)
    at javafx.fxml/com.sun.javafx.fxml.MethodHelper.invoke(MethodHelper.java:83)
    at javafx.fxml/javafx.fxml.FXMLLoader$MethodHandler.invoke(FXMLLoader.java:1782)
    at javafx.fxml/javafx.fxml.FXMLLoader$ControllerMethodEventHandler.handle(FXMLLoader.java:1670)
    at javafx.base/com.sun.javafx.event.CompositeEventHandler.dispatchBubblingEvent(CompositeEventHandler.java:86)
    at javafx.base/com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:238)
    at javafx.base/com.sun.javafx.event.EventHandlerManager.dispatchBubblingEvent(EventHandlerManager.java:191)
    at javafx.base/com.sun.javafx.event.CompositeEventDispatcher.dispatchBubblingEvent(CompositeEventDispatcher.java:59)
    at javafx.base/com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(BasicEventDispatcher.java:58)
    at javafx.base/com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(EventDispatchChainImpl.java:114)
    at javafx.base/com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(BasicEventDispatcher.java:56)
    at javafx.base/com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(EventDispatchChainImpl.java:114)
    at javafx.base/com.sun.javafx.event.BasicEventDispatcher.dispatchEvent(BasicEventDispatcher.java:56)
    at javafx.base/com.sun.javafx.event.EventDispatchChainImpl.dispatchEvent(EventDispatchChainImpl.java:114)
    at javafx.base/com.sun.javafx.event.EventUtil.fireEventImpl(EventUtil.java:74)
    at javafx.base/com.sun.javafx.event.EventUtil.fireEvent(EventUtil.java:54)
    at javafx.base/javafx.event.Event.fireEvent(Event.java:198)
    at javafx.graphics/javafx.scene.Scene$ClickGenerator.postProcess(Scene.java:3589)
    at javafx.graphics/javafx.scene.Scene$ClickGenerator.access$8300(Scene.java:3517)
    at javafx.graphics/javafx.scene.Scene$MouseHandler.process(Scene.java:3885)
    at javafx.graphics/javafx.scene.Scene$MouseHandler.access$1300(Scene.java:3604)
    at javafx.graphics/javafx.scene.Scene.processMouseEvent(Scene.java:1874)
    at javafx.graphics/javafx.scene.Scene$ScenePeerListener.mouseEvent(Scene.java:2613)
    at javafx.graphics/com.sun.javafx.tk.quantum.GlassViewEventHandler$MouseEventNotification.run(GlassViewEventHandler.java:397)
    at javafx.graphics/com.sun.javafx.tk.quantum.GlassViewEventHandler$MouseEventNotification.run(GlassViewEventHandler.java:295)
    at java.base/java.security.AccessController.doPrivileged(Native Method)
    at javafx.graphics/com.sun.javafx.tk.quantum.GlassViewEventHandler.lambda$handleMouseEvent$2(GlassViewEventHandler.java:434)
    at javafx.graphics/com.sun.javafx.tk.quantum.QuantumToolkit.runWithoutRenderLock(QuantumToolkit.java:389)
    at javafx.graphics/com.sun.javafx.tk.quantum.GlassViewEventHandler.handleMouseEvent(GlassViewEventHandler.java:433)
    at javafx.graphics/com.sun.glass.ui.View.handleMouseEvent(View.java:556)
    at javafx.graphics/com.sun.glass.ui.View.notifyMouse(View.java:942)
    at javafx.graphics/com.sun.glass.ui.win.WinApplication._runLoop(Native Method)
    at javafx.graphics/com.sun.glass.ui.win.WinApplication.lambda$runLoop$3(WinApplication.java:189)
    at java.base/java.lang.Thread.run(Thread.java:844)

Process finished with exit code 0

顺便说一句，这是我的 orderListTableModel

public class orderListTableModel {
    String id, foodName, qty, price;

    public orderListTableModel(String id, String foodName, String qty, String price) {
        this.id = id;
        this.foodName = foodName;
        this.qty = qty;
        this.price = price;
    }

    public String getId() {
        return id;
    }

    public void setId(String id) {
        this.id = id;
    }

    public String getFoodName() {
        return foodName;
    }

    public void setFoodName(String foodName) {
        this.foodName = foodName;
    }

    public String getQty() {
        return qty;
    }

    public void setQty(String qty) {
        this.qty = qty;
    }

    public String getPrice() {
        return price;
    }

    public void setPrice(String price) {
        this.price = price;
    }
}

Answer 1

您无法使用PreparedStatement 将表名绑定(bind)到SQL 查询。 PreparedStatement 适用于列名称，而不是表名称。我知道 orderRefNo 引用了一个 String 对象，但在构建查询时，您仍然将其绑定(bind)为 SELECT 语句中使用的表。

PreparedStatement preparedStatement = connection.prepareStatement("**SELECT * FROM ?**");
preparedStatement.setString(1, orderRefNo);

了解您在查询中使用字符串 orderRefNo 作为表名称，这是不允许的。因此你会得到一个异常。

实现此目的的另一种方法是将表名连接到查询中，但您不应该永远不要这样做，因为这会使您的代码容易受到 SQL 注入(inject)攻击。我再说一遍，不要将表名直接连接到查询中。