Java 和 MySql SELECT 查询中的 SQL 语法错误

Question

我正在开发一个包含 3 个 JFrame 的基本程序。成功登录后将打开一个登录、一个注册和一个仪表板。但是，我在输入用户名和密码并单击登录按钮后出现错误。

这是错误：

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: 你的 SQL 语法有错误；查看与您的 MariaDB 服务器版本相对应的手册，了解在第 1 行的“password='1234”附近使用的正确语法

这是我的代码：

import java.awt.BorderLayout;
import java.awt.EventQueue;

import javax.swing.JFrame;
import javax.swing.JPanel;
import javax.swing.border.EmptyBorder;

import com.mysql.jdbc.Statement;

import javax.swing.JLabel;
import javax.swing.JOptionPane;
import javax.swing.ImageIcon;
import java.awt.Font;
import javax.swing.JTextField;
import javax.swing.JButton;
import java.awt.event.ActionListener;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.awt.event.ActionEvent;

public class Login extends JFrame {

private JPanel contentPane;
private JTextField txtUsrName;
private JTextField txtPAss;

/**
 * Launch the application.
 */
public static void main(String[] args) {
    EventQueue.invokeLater(new Runnable() {
        public void run() {
            try {
                Login frame = new Login();
                frame.setVisible(true);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    });
}

/**
 * Create the frame.
 */
public Login() {
    setDefaultCloseOperation(JFrame.HIDE_ON_CLOSE);
    setBounds(100, 100, 450, 348);
    contentPane = new JPanel();
    contentPane.setBorder(new EmptyBorder(5, 5, 5, 5));
    setContentPane(contentPane);
    contentPane.setLayout(null);

    JLabel lblLogin = new JLabel("Welcome To TechApp");
    lblLogin.setFont(new Font("Tekton Pro", Font.PLAIN, 18));
    lblLogin.setBounds(135, 19, 163, 28);
    contentPane.add(lblLogin);

    JLabel lblUsername = new JLabel("UserName:");
    lblUsername.setFont(new Font("Alaska", Font.PLAIN, 15));
    lblUsername.setBounds(174, 58, 88, 28);
    contentPane.add(lblUsername);

    txtUsrName = new JTextField();
    txtUsrName.setBounds(145, 90, 132, 20);
    contentPane.add(txtUsrName);
    txtUsrName.setColumns(10);

    JLabel lblPassword = new JLabel("Password:");
    lblPassword.setFont(new Font("Alaska", Font.PLAIN, 15));
    lblPassword.setBounds(182, 118, 95, 46);
    contentPane.add(lblPassword);

    txtPAss = new JTextField();
    txtPAss.setColumns(10);
    txtPAss.setBounds(145, 156, 132, 20);
    contentPane.add(txtPAss);

    JButton btnNewButton = new JButton("login");
    btnNewButton.addActionListener(new ActionListener() {
        public void actionPerformed(ActionEvent e) {


            String _username = txtUsrName.getText();
            String _password = txtPAss.getText();
            String url = "jdbc:mysql://127.0.0.1:3306/javabase";
            String user = "java";
            String passw = "password";

            try{
                // 1.Get a connection To Database
                Connection myConn = DriverManager.getConnection(url, user, passw);

                // 2.Create a statement
                Statement myStmt = (Statement) myConn.createStatement();

                // 3.Execute SQL Query
                String sql = "SELECT userame, password FROM registration WHERE userame='"+_username+"', password='"+_password+"' ";
                ResultSet result = myStmt.executeQuery(sql);
                //myStmt.executeUpdate(sql);

                int count = 0;
                while(result.next()){
                    count = count + 1;
                }
                if(count == 1){
                    Dashboard frame = new Dashboard();
                    frame.setVisible(true);
                }
                else if(count > 1){
                    JOptionPane.showMessageDialog(null, "Duplicate User! Access Denied!");
                }
                else{
                    JOptionPane.showMessageDialog(null, "User Not Found!");
                }


            }
            catch(Exception ex)
            {
                ex.printStackTrace();
            }





        }
    });
    btnNewButton.setBounds(169, 202, 89, 49);
    contentPane.add(btnNewButton);

    JButton btnRegister = new JButton("Register");
    btnRegister.addActionListener(new ActionListener() {
        public void actionPerformed(ActionEvent e) {
            Main frame = new Main();
            frame.setVisible(true);
        }
    });
    btnRegister.setBounds(168, 264, 89, 23);
    contentPane.add(btnRegister);

    JLabel lblNewLabel = new JLabel("");
    lblNewLabel.setFont(new Font("Alaska", Font.PLAIN, 16));
    lblNewLabel.setIcon(new ImageIcon("D:\\ExploitGate\\MAS-9831-Offwhite2.jpg"));
    lblNewLabel.setBounds(0, 0, 434, 310);
    contentPane.add(lblNewLabel);
}
}

我搜索了 stackoverflow 论坛并执行了here 给出的可能解决方案 谁能指导我如何处理这个错误？ 提前致谢:)

Answer 1

上面所有的代码基本上都是没用的。这是一个 SQL 语法错误，这意味着它是这一行：

... WHERE userame='"+_username+"', password='"+_password+"' ";
                                 ^---

您不要使用 , 来分隔 where 子句参数。您使用布尔运算。 and、or等……

请注意，您很容易受到sql injection attacks的攻击

Answer 2

您在 WHERE 子句之间使用了逗号 ,，而不是 AND。

String sql = "SELECT userame, password FROM registration WHERE userame='"+_username+"' AND password='"+_password+"' ";