带有变量的Java JDBC查询？

Question

String poster = "user";

Statement stmt = con.createStatement();
ResultSet rs = stmt.executeQuery("SELECT * FROM `prices` WHERE `poster`="+poster);

这不起作用.任何提示或技巧将不胜感激.

Answer 1

尝试poster使用单引号包围变量,如下所示:

ResultSet rs = stmt.executeQuery("SELECT * FROM `prices` WHERE `poster`='"+poster+"'");

那是因为SQL期望字符串被单引号括起来.更好的选择是使用准备好的语句:

PreparedStatement stmt = con.prepareStatement("SELECT * FROM `prices` WHERE `poster` = ?");
stmt.setString(1, poster);
ResultSet rs = stmt.executeQuery();

建议使用,PreparedStatement因为您当前构建查询的方式(通过连接字符串)使攻击者可以轻松地在查询中注入任意SQL代码,这是一种称为SQL注入的安全威胁.