java - Java内部Oracle查询

Question

String sql = "INSERT INTO Student_Info(name,roll_no,address,phone_no) VALUES('101', 1, 'Fatma', '25')";

String sql = "insert into Student_Info(name,roll_no,address,phone_no) VALUES("+student.getName()+","+student.getRoll_no()+","+student.getAddress()+","+student.getPhone_no()+")";

最后一个查询显示错误:

java.sql.SQLException: ORA-00917: missing comma

在

statement.executeUpdate(sql);

谁能排除我在哪里漏掉了逗号吗？

Answer 1

您错过了 Student.name、student.address 和 Student.phone_no 周围的单引号

String sql = "insert into Student_Info(name,roll_no,address,phone_no) VALUES('"+
              student.getName()+"',"+
              student.getRoll_no()+",'"+
              student.getAddress()+"','"+
              student.getPhone_no()+"')";

请注意，此 sql 语句容易受到 sql 注入(inject)攻击。使用PreparedStatement .

  String sql = "insert into Student_Info(name,roll_no,address,phone_no) " +
               "VALUES(?,?,?,?)"; 

  addStudent = con.prepareStatement(sql);
  addStudent.setString(1, student.getName());
  addStudent.setInt(2, student.getRoll_no());
  addStudent.setString(3, student.getAddress());
  addStudent.setString(4, student.getPhone_no());
  addStudent.executeUpdate();
  con.commit();