java - 简单的 JSP 页面未加载

Question

以下 jsp 代码出现错误:

 <%@ page import ="java.sql.*" %>
<%@ page import ="javax.sql.*" %>
<%
String user=request.getParameter("userid"); 
session.putValue("userid",user); 
String pwd=request.getParameter("pwd"); 
String fname=request.getParameter("fname"); 
String lname=request.getParameter("lname"); 
String email=request.getParameter("email"); 
Class.forName("com.mysql.jdbc.Driver"); 
java.sql.Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/test",
"root","123"); 
Statement st= con.createStatement(); 
ResultSet rs; 
int i=st.executeUpdate("insert into users values ('"+user+"','"+pwd+"','"+fname+"',
'"+lname+"','"+email+"')"); 


%>

得到的错误如下:

org.apache.jasper.JasperException: Unable to compile class for JSP: 

An error occurred at line: 15 in the jsp file: /db/reg.jsp
String literal is not properly closed by a double-quote
12: "root","123"); 
13: Statement st= con.createStatement(); 
14: ResultSet rs; 
15: int i=st.executeUpdate("insert into users values ('"+user+"','"+pwd+"','"+fname+"',
16: '"+lname+"','"+email+"')"); 
17: 
18: 


Stacktrace:
    org.apache.jasper.compiler.DefaultErrorHandler.javacError(DefaultErrorHandler.java:102)
    org.apache.jasper.compiler.ErrorDispatcher.javacError(ErrorDispatcher.java:331)
    org.apache.jasper.compiler.JDTCompiler.generateClass(JDTCompiler.java:469)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:378)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:353)
    org.apache.jasper.compiler.Compiler.compile(Compiler.java:340)
    org.apache.jasper.JspCompilationContext.compile(JspCompilationContext.java:646)
    org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:357)
    org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:390)
    org.apache.jasper.servlet.JspServlet.service(JspServlet.java:334)
    javax.servlet.http.HttpServlet.service(HttpServlet.java:722)

我不知道这里出了什么问题。我是jsp新手，所以请帮我做一个简单的解释。 jsp 文件的端口号、用户名密码以及其他所有内容均正确。还有什么我忽略的吗？请帮我纠正错误。

Answer 1

首先，don't use scriptlets in JSP file ，您可以在 Servlet 或某些 DAO 类中拥有此逻辑。

接下来，下面的行应该是单行:

java.sql.Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/test","root","123"); 

甚至将其放在一行中:

int i=st.executeUpdate("insert into users values ('"+user+"','"+pwd+"','"+fname+"','"+lname+"','"+email+"')"); 

更好地构造带有占位符的查询字符串并使用 PreparedStatement并设置每个值。它将防止所有这些字符串格式问题以及 SQL Injection .

String query = "insert into users values (?,?,?,?,?,?)";
PreparedStatement statement = connection.prepareStatement(query);
statement.setString(user);
.............
.............
int updateSuccessful = statement.executeUpdate();