com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException：'字段列表'中的未知列'Knight'

Question

我不知道爲什麼當MySQL的其他代碼完美工作時不想合作，它只是當我嘗試設置一個字符串。

的MySQLManager類：

http://pastebin.com/RWavasPh

我做變更表中添加另一列：

try 
{ 
    McInfected.getMySQLManager().execute("ALTER TABLE McInfected ADD Rank VARCHAR(20);"); 
} 
catch (SQLException e) 
{ 
} 

然後我RanksManager類（指的是它的套行列）

http://pastebin.com/T0nRKkv7

任何幫助將不勝感激，因爲我幾乎準備好扔我的電腦...

我試圖看看其他問題的答案，但我真的不知道如何解決它在我的例如，據我可以告訴它與訪問類型做的，但我不知道該怎麼做來解決它......

這是錯誤

11:29:49 PM [WARNING] com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Unknown column 'Knight' in 'field list' 11:29:49 PM [WARNING] at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) 11:29:49 PM [WARNING] at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source) 11:29:49 PM [WARNING] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source) 11:29:49 PM [WARNING] at java.lang.reflect.Constructor.newInstance(Unknown Source) 11:29:49 PM [WARNING] at com.mysql.jdbc.Util.handleNewInstance(Util.java:407) 11:29:49 PM [WARNING] at com.mysql.jdbc.Util.getInstance(Util.java:382) 11:29:50 PM [WARNING] at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:1052) 11:29:50 PM [WARNING] at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3593) 11:29:50 PM [WARNING] at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3525) 11:29:50 PM [WARNING] at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1986) 11:29:50 PM [WARNING] at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2140) 11:29:50 PM [WARNING] at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2620) 11:29:50 PM [WARNING] at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2570) 11:29:50 PM [WARNING] at com.mysql.jdbc.StatementImpl.execute(StatementImpl.java:779) 11:29:50 PM [WARNING] at com.mysql.jdbc.StatementImpl.execute(StatementImpl.java:622) 11:29:50 PM [WARNING] at com.bimmr.mcinfected.MySQL.MySQLManager.updateString(MySQLManager.java:338) 11:29:50 PM [WARNING] at me.bimmr.mcinfectedranks.Ranks.RankManager.setPlayersRank(RankManager.java:173)

Answer 1

在MySqlManager.updateString value沒有引用，都沒有轉義。

this.statement.execute("UPDATE " + tableName 
    + " SET " + columnName + "=" + value 
    + " WHERE UUID ='" + 

應該是：

this.statement.execute("UPDATE " + tableName 
    + " SET " + columnName + "='" + value.replaceAll("'", "\\\\'") 
    + "' WHERE UUID ='" + 

更妙的是：使用PreparedStatement做對SQL注入的轉義和安全防護裝置。