上查詢

Question

的Java + MySQL錯誤我編程的Java和Eclipse正顯示出我這個錯誤：

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''where Name=''and Password=''' at line 1 

我試圖修復查詢，但錯誤remains.Can你控制，如果我正確地編寫查詢？我想創建這個類不重複所有類中的連接。但這不是錯誤。

text1,2,3是文本框。我想通過文本框3.

String name = text1.getText(); 

String password = text2.getText(); 

String employment = text3.getText(); 

try { 

ResultSet rs = Connection.Creation().executeQuery("select * from '" + employment + 
"'where Name='" + name + "'and Password='" + password + "'"); 
} 
catch 
{ 
//something here 
} 

Answer 1

Try this 

MySQL Identifiers 

The identifier quote character is the backtick ("`") in MySQL. 

ResultSet rs = Connection.Creation().executeQuery("select * from `" + employment + 
"` where Name='" + name + "'and Password='" + password + "'"); 

Answer 2

ResultSet rs = Connection.Creation().executeQuery(" 
select * from " + employment + " where Name='" + name + "' and Password='" + password + "'"); 

的距離不應該有'拿到表名。

正如我在評論中所說的，這種方式對SQL注入非常脆弱。