我的Oracle SQL語句有什麼問題？我不斷收到一個不允許在這裏的列錯誤？

Question

好吧，我的SQL * Plus語句有什麼問題？據我可以告訴一切應該工作？

//get parameters from the request 
String custID=request.getParameter("cust_ID"); 
String saleID=request.getParameter("sale_ID"); 
String firstName=request.getParameter("first_Name"); 
String mInitial=request.getParameter("mI"); 
String lastName=request.getParameter("last_Name"); 
String streetName=request.getParameter("street"); 
String city=request.getParameter("city"); 
String state=request.getParameter("state"); 
String zipCode=request.getParameter("zip_Code"); 
String DOB=request.getParameter("DOB"); 
String agentID=request.getParameter("agent_ID"); 
String homePhone=request.getParameter("home_Phone"); 
String cellPhone=request.getParameter("cell_Phone"); 
String profession=request.getParameter("profession"); 
String employer=request.getParameter("emoployer"); 
String referrer=request.getParameter("referrer"); 

stmt.executeUpdate("INSERT INTO customer 
         (cust_ID, sale_ID, first_Name, mI, last_Name, street_Name, city, state, zip_Code, DOB, agent_ID, home_Phone, cell_Phone, profession, employer, referrer)" 
        + " VALUES 
         (custID, saleID, firstName, mInitial, lastName, streetName, city, state, zipCode, DOB, agentID, homePhone, cellPhone, profession, employer, referrer)"); 

SQL DDL

CREATE TABLE customer 
     (cust_ID  NUMBER   NOT NULL, 
     sale_ID    NUMBER   NOT NULL, 
     first_Name  VARCHAR2(30)  NOT NULL, 
     mI   VARCHAR2(2)   , 
     last_Name  VARCHAR2(50)  NOT NULL, 
     street_Name  VARCHAR2(50)  NOT NULL, 
     city   VARCHAR2(30)  NOT NULL, 
     state   VARCHAR2(2)  NOT NULL, 
     zip_Code  VARCHAR2(5)  NOT NULL, 
     DOB   DATE   , 
     agent_ID  NUMBER    , 
     home_Phone  VARCHAR2(12)  UNIQUE,   
     cell_Phone  VARCHAR2(12)  UNIQUE, 
     profession  VARCHAR2(30)   , 
     employer  VARCHAR2(30)   , 
     referrer  VARCHAR2(30)    
    );  

SQL DML

INSERT INTO customer 
VALUES (primary_ID.nextval,17,'Kito','M','Bradford','123 DeLancy Lane','Wabash','TX','12345','01-JAN-69',1,'222-222-2222','301-555-6874','software engineer','HPL', NULL); 

INSERT INTO customer 
VALUES (primary_ID.nextval,18,'Morpheus',' ','Smith','1289 Matrix Lane','Idaho', 'NE', '45678','06-JUN-72',2,'321-654-9877','258-852-9635','doctor', 'The OC', NULL); 

SELECT * FROM customer; 

Answer 1

你是不是插入變量的值。您正在插入變量名稱。

更換

stmt.executeUpdate("INSERT INTO customer 
         (cust_ID, sale_ID, first_Name, mI, last_Name, street_Name, city, state, zip_Code, DOB, agent_ID, home_Phone, cell_Phone, profession, employer, referrer)" 
        + " VALUES 
         (custID, saleID, firstName, mInitial, lastName, streetName, city, state, zipCode, DOB, agentID, homePhone, cellPhone, profession, employer, referrer)"); 

通過

preparedStatement = connection.prepareStatement("INSERT INTO customer 
         (cust_ID, sale_ID, first_Name, mI, last_Name, street_Name, city, state, zip_Code, DOB, agent_ID, home_Phone, cell_Phone, profession, employer, referrer)" 
        + " VALUES 
         (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); 
preparedStatement.setLong(1, Long.valueOf(custID)); 
preparedStatement.setLong(2, Long.valueOf(saleID)); 
preparedStatement.setString(3, firstName); 
// ... 
preparedStatement.executeUpdate(); 

請注意，你不應該使用字符串連接+到SQL字符串變量粘合在一起。它將完全開放給SQL injection攻擊。一路使用PreparedStatement。