【问题标题】:Java/JDBC/SQLite - Issue with Updating BLOBJava/JDBC/SQLite - 更新 BLOB 的问题
【发布时间】:2017-05-07 02:44:58
【问题描述】:

我在更新 Blob 时遇到问题,问题是 pst.executeUpdate 没有执行,但是,如果我取出与 Blob/Tryinng 相关的所有内容来更新 Blob,其他所有内容都会更新,即 ID 、姓名、地址等。一切正常,问题出在 Blob 上。

 updateEmployee.addActionListener(new ActionListener() {

        @Override
        public void actionPerformed(ActionEvent e) {
            // TODO Auto-generated method stub
            Connection connection = null;
            PreparedStatement pst = null;

            try {

                Class.forName("org.sqlite.JDBC");
                connection = DriverManager.getConnection("jdbc:sqlite:employeeDatabase.sqlite");
                connection.setAutoCommit(false);



                int idVal = Integer.parseInt(idTextField.getText());
                String nameVal= nameTextField.getText();
                String genderVal = genderTextField.getText();
                String dobVal = dobTextField.getText();
                String addressVal = addressTextField.getText();
                String postcodeVal =  postcodeTextField.getText();
                String ninVal =  ninTextField.getText();
                String jobVal =  jobtitleTextField.getText();
                String startDateVal =  startdateTextField.getText();
                String salaryVal = salaryTextField.getText();
                String emailVal =  emailTextField.getText();
                //Icon photoBlob = photoLabel.getIcon();
                InputStream img = new FileInputStream(s);
                String sql = "UPDATE employees set ID= '"+ idVal+"', Name = '"+ nameVal +"', Gender ='"+ genderVal+"', DOB='"+ dobVal+"', Address ='"+ addressVal+"', Postcode ='"+ postcodeVal+"', NIN ='"+ ninVal+"', JobTitle='"+ jobVal+"', StartDate ='"+ startDateVal+"', Salary ='"+ salaryVal+"', Email='"+ emailVal+"', Images='"+ img+" WHERE ID= '"+ idVal+"'";

                pst = connection.prepareStatement(sql);
                pst.setInt(1,Integer.parseInt(idTextField.getText()));
                pst.setString(2, nameTextField.getText());
                pst.setString(3, genderTextField.getText());
                pst.setString(4, dobTextField.getText());
                pst.setString(5, addressTextField.getText());
                pst.setString(6, postcodeTextField.getText());
                pst.setString(7, ninTextField.getText());
                pst.setString(9, startdateTextField.getText());
                pst.setString(10, salaryTextField.getText());
                pst.setString(11, emailTextField.getText());
                pst.setBytes(12, readFile(s));

                pst.executeUpdate();




                System.out.println("Employee Updated");
                JOptionPane.showMessageDialog(null, "Employee has successfully been updated");              


                 connection.commit();
                pst.close();
                connection.close();
            }
            catch ( Exception e1 ) {

                if(idTextField.getText().equals("")){
                    JOptionPane.showMessageDialog(null, "Please Ensure An Employee Has Been Selected");
                }
            }
        }});

编辑 -

但是,我可以插入和删除 blob 文件以及检索。只是这个更新给了我一个问题。

【问题讨论】:

  • 再一次,在任何情况下都不要将参数值连接到 SQL 语句中,这会导致 SQL 注入攻击。请仔细阅读并使用preparedStatement 和setParameter,这样有一天,您将不会对泄露我的信用卡或密码的黑客行为负责。
  • @TonyBenBrahim 那么......

标签: java sql sqlite jdbc blob


【解决方案1】:

您的 SQL 命令文本对于参数化查询无效。而不是创建具有嵌入值的动态 SQL 命令字符串...

String sql = "UPDATE employees set ID= '"+ idVal+"', Name = '"+ nameVal +"', Gender ='"+ genderVal+"', DOB='"+ dobVal+"', Address ='"+ addressVal+"', Postcode ='"+ postcodeVal+"', NIN ='"+ ninVal+"', JobTitle='"+ jobVal+"', StartDate ='"+ startDateVal+"', Salary ='"+ salaryVal+"', Email='"+ emailVal+"', Images='"+ img+" WHERE ID= '"+ idVal+"'";

...您应该使用带有问号的命令字符串作为参数占位符...

String sql = "UPDATE employees set ID = ?, Name = ?, Gender = ?, DOB = ?, Address = ?, Postcode = ?, NIN = ?, JobTitle = ?, StartDate = ?, Salary = ?, Email = ?, Images = ? WHERE ID = ?;

...然后使用.setInt.setString.setBytes设置参数值。

(另请注意,当您使用... WHERE ID = ? 时,“ID”值实际上对SET 是多余的。)

【讨论】:

  • 感谢您的回答。它在执行方面确实有效,但不会更新数据库。
  • executeUpdate 应该返回一个 int 值,指示受影响的行数,因此请验证它不为零。还要确保您以正确的顺序指定了正确数量的参数,并且它们的类型正确。
  • BLOB 还是有问题,不过没关系。我不会为更新而大惊小怪。
猜你喜欢
  • 2017-05-07
  • 2011-09-03
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
  • 1970-01-01
相关资源
最近更新 更多