JavaFX的文本字段到MySQL INSERT：SQL語法錯誤

Question

我有一個MySQL表看起來像這樣：

​​

我在我的形式做了一些文本框，並保存輸入的字符串：

String name = shopname.getText(); 
    String address = streetaddress.getText(); 
    String city = cityname.getText(); 
    String state = statename.getText(); 
    String country = countryname.getText(); 
    String zip = zipcode.getText(); 
    String phonept1 = phonecountryid.getText(); 
    String phonept2 = phoneareaid.getText(); 
    String phonept3 = phoneothernumber.getText(); 
    String phonefull = phonept2 + " " + "(" + phonept1 + ")" + " " + phonept3; 

然後，我只是做了它與舊SQLite數據庫行之有效的insert方法：

  conn = DBConnect.Connector(); 
      stmt = conn.createStatement(); 
      stmt.executeUpdate("INSERT INTO shopList (name,address,city,state,country,zipcode,phonefull) VALUES(" +name+ "," + address + "," + city + "," + state + "," + country + "," + zip + "," + phonefull + ")"); 
      conn.close(); 

但現在它說：

SEVERE：null com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException：您的SQL語法有錯誤;請檢查與您的MySQL服務器版本對應的手冊，以便在第1行'（22）222222）'處使用正確的語法'

任何人都可以看到語法錯誤？

ps。 （22）222222是經過測試的phonefull輸入。

Answer 1

conn = DBConnect.Connector(); 
stmt = conn.createStatement(); 
stmt.executeUpdate("INSERT INTO shopList (name,address,city,state,country,zipcode,phonefull) VALUES('" +name+ "','" + address + "','" + city + "','" + state + "','" + country + "','" + zip + "','" + phonefull + "')"); 
conn.close(); 

試試這個（我已經包裹你的字符串值在單引號）

編輯：

直接傳遞字符串值，您正在離開自己容易受到SQL注入。如果可能，您要使用PreparedStatement對象和setString方法。