如何从Java发送参数化DELETE到MySql

Question

我想从PersonnelTable以下方式调用的表中删除:

public void verifyDetailsBeforeClosingAccount(String _idNumber,String _username,String _password ,String _account)
{

    String retrievedNumberAccount = null;
    String retrievedOwnerIdnumber = null;

    try
    {

        // take all the rows with "account-number" and "id-numbder" in the "Checking-account-table" 

        ResultSet results = this.m_statement.executeQuery("SELECT `AccountNumber`, `IdNumber`  FROM `CheckingAccountsTable`");  
        while (results.next() == true)
        {
            retrievedNumberAccount = results.getString("AccountNumber");  // take the account number 
            retrievedOwnerIdnumber = results.getString("IdNumber");       // take the ID number 

            if (retrievedNumberAccount.equals(_account) == true && retrievedOwnerIdnumber.equals(_idNumber) == true )  // found a partial match 
            {
                // put something here
            }
        }
    }
}

我想删除一行PersonnelTable,其中:

1. Password表中的列等于_password给定的函数,
2. UserName表中的列等于username给函数的_ .

这不起作用:

this.m_statement.executeQuery("DELETE FROM `PersonnelTable` WHERE `Password` = _password AND `UserName` =_username ");

我已经查看了教程,DELETE但没有说明如何将给定的值处理成函数.我怎样才能解决这个问题 ？

问候

Answer 1

用单引号包装值,因为它是一个字符串.对？

this.m_statement.executeQuery("DELETE FROM `PersonnelTable` 
                               WHERE `Password` = '" + _password + "' AND 
                                     `UserName` = '" + _username + "' ");

为此更好的Java准备声明.

前

string sqlStatement = "DELETE FROM `PersonnelTable` 
                                   WHERE `Password` = ? AND 
                                         `UserName` = ? ";
PreparedStatement pstmt = con.prepareStatement(sqlStatement);
pstmt.setString(1, _password)
pstmt.setString(2, _username)
pstmt.executeUpdate();

Answer 2

你正在做的是删除用户名为"_username"的记录(不是传递给你的值,但字面意思是"_username")

你必须要么:

a)传递值而不是变量的名称:

 statement.executeQuery("DELETE FROM `PersonnelTable` WHERE `Password` = `" + _password + "` AND `UserName` = `" + _username + "` ");

b)使用PreparedStatement(建议用于避免SQL注入攻击).

编辑:在旁注上,如果用户名是注册表的密钥(唯一标识符),添加密码检查只会减慢操作速度,使程序复杂化(如果有人同时更改密码怎么办？)并且没有任何优势.

Answer 3

您需要使用预准备语句并将值作为参数传递.

 String deleteString = "DELETE FROM `PersonnelTable` WHERE `Password` = ? AND `UserName` = ? ";

 PreparedStatement deleteStmt = con.prepareStatement(deleteString);

 deleteStmt.setString(1, _password);  // Use whatever the object type of user/password are
 deleteStmt.setString(2, _username);

 deleteStmt.executeUpdate();
 con.commit();