Java SQL异常命令未正确结束

Question

请帮我解决以下问题。使用下面的代码

 if (con == null || con.isClosed()) con = DBBase.getNewConnection();
    sb = con.createStatement();

    resSet = sb.executeQuery("select * from  USERSAGGRS  where userid='" +user.getUserid()+ "'  AND  id='" +aggid+ "'  ");

加载 jsp 页面时出现此错误:

java.sql.SQLException: ORA-00933: SQL command not properly ended

Answer 1

很可能是 user.getUserid() 和/或 aggid 的值出现问题。您可以通过打印查询来测试它并在任何 Oracle DBMS 客户端中进行测试。

System.out.println("select * from  USERSAGGRS  where userid='" +user.getUserid()+ "'  AND  id='" +aggid+ "'  ")

奥托

正确的方法是使用 PreparedStatement

if (con == null || con.isClosed()) con = DBBase.getNewConnection();
    String SQL = "select * from  USERSAGGRS  where userid=?  AND  id=?"
    sb = con.prepareStatement(SQL);
    sb.setString(1,user.getUserid());
    sb.setString(2,aggid);
    resSet = sb.executeQuery();

通过使用PreparedStatement，您还可以避免 SQLInjections