【发布时间】:2017-05-07 02:44:58
【问题描述】:
我在更新 Blob 时遇到问题,问题是 pst.executeUpdate 没有执行,但是,如果我取出与 Blob/Tryinng 相关的所有内容来更新 Blob,其他所有内容都会更新,即 ID 、姓名、地址等。一切正常,问题出在 Blob 上。
updateEmployee.addActionListener(new ActionListener() {
@Override
public void actionPerformed(ActionEvent e) {
// TODO Auto-generated method stub
Connection connection = null;
PreparedStatement pst = null;
try {
Class.forName("org.sqlite.JDBC");
connection = DriverManager.getConnection("jdbc:sqlite:employeeDatabase.sqlite");
connection.setAutoCommit(false);
int idVal = Integer.parseInt(idTextField.getText());
String nameVal= nameTextField.getText();
String genderVal = genderTextField.getText();
String dobVal = dobTextField.getText();
String addressVal = addressTextField.getText();
String postcodeVal = postcodeTextField.getText();
String ninVal = ninTextField.getText();
String jobVal = jobtitleTextField.getText();
String startDateVal = startdateTextField.getText();
String salaryVal = salaryTextField.getText();
String emailVal = emailTextField.getText();
//Icon photoBlob = photoLabel.getIcon();
InputStream img = new FileInputStream(s);
String sql = "UPDATE employees set ID= '"+ idVal+"', Name = '"+ nameVal +"', Gender ='"+ genderVal+"', DOB='"+ dobVal+"', Address ='"+ addressVal+"', Postcode ='"+ postcodeVal+"', NIN ='"+ ninVal+"', JobTitle='"+ jobVal+"', StartDate ='"+ startDateVal+"', Salary ='"+ salaryVal+"', Email='"+ emailVal+"', Images='"+ img+" WHERE ID= '"+ idVal+"'";
pst = connection.prepareStatement(sql);
pst.setInt(1,Integer.parseInt(idTextField.getText()));
pst.setString(2, nameTextField.getText());
pst.setString(3, genderTextField.getText());
pst.setString(4, dobTextField.getText());
pst.setString(5, addressTextField.getText());
pst.setString(6, postcodeTextField.getText());
pst.setString(7, ninTextField.getText());
pst.setString(9, startdateTextField.getText());
pst.setString(10, salaryTextField.getText());
pst.setString(11, emailTextField.getText());
pst.setBytes(12, readFile(s));
pst.executeUpdate();
System.out.println("Employee Updated");
JOptionPane.showMessageDialog(null, "Employee has successfully been updated");
connection.commit();
pst.close();
connection.close();
}
catch ( Exception e1 ) {
if(idTextField.getText().equals("")){
JOptionPane.showMessageDialog(null, "Please Ensure An Employee Has Been Selected");
}
}
}});
编辑 -
但是,我可以插入和删除 blob 文件以及检索。只是这个更新给了我一个问题。
【问题讨论】:
-
再一次,在任何情况下都不要将参数值连接到 SQL 语句中,这会导致 SQL 注入攻击。请仔细阅读并使用preparedStatement 和setParameter,这样有一天,您将不会对泄露我的信用卡或密码的黑客行为负责。
-
@TonyBenBrahim 那么......