2013-11-26 47 views
0
String sql = "INSERT INTO order " + "(customerid, pant, shirt, date) " 
    + "VALUES ('" + jTextField1.getText() + "','" + jTextField2.getText() 
    + "','" + jTextField3.getText() + "','" + jTextField4.getText() + "')"; 

當嘗試這樣做,我得到了以下錯誤:SQL語法錯誤MySQLSyntaxErrorException

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; 
    check the manual that corresponds to your MySQL server version for the right syntax to use near 
    'order (customerid, pant, shirt, date) VALUES ('10','2','3','26')' at line 1 
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method). 
+0

此代碼只是乞求SQL注入攻擊。不要對SQL使用字符串連接,使用PreparedStatements和查詢參數來表達對人類的熱愛。 – brettw

回答

4

你需要逃避reserved wordsorder與反引號

INSERT INTO `order` (customerid, ... 

除此之外,我建議使用準備報表

+0

是的你是對的。我知道了。 –

0

表名「order」是保留字,所以請更改表名並嘗試它。