sqlcommand 未正确结束答案

【问题标题】：sqlcommand not properly endedsqlcommand 未正确结束
【发布时间】：2015-06-18 14:30:29
【问题描述】：

我无法更新我的表单。它说我的 sql 没有正确结束。这是我的 custDao 的 updateCust。 ResultSet 似乎没有被使用。似乎直接去捕获异常。

 public void updateCust(Customer cust) {
  try {
    Statement statement = con.createStatement();
    ResultSet rs = statement.executeQuery("UPDATE CUSTOMER "
            + "SET custName =        '" + cust.getCustName() + "',"
            + "custAdd = '" + cust.getCustAdd() + "',"
            + "custRegion = '" + cust.getCustRegion() + "' "
            + "custHandphoneNo = '" + cust.getCustHandphoneNo() + "' "
            + "custPhoneNo = '" + cust.getCustPhoneNo() + "' "
            + "custEmail = '" + cust.getCustEmail() + "' "
            + "WHERE cust_id = " + cust.getCust_id());
  } catch (SQLException e) {
    e.printStackTrace();
    System.out.println("problem update");
  }
}

这是我从搜索框中检索数据后的表单

<form action="CustomerController?action=edit" method="post">
    <table>
        <tr>
            <td style:width="30px"><h3 class="templatemo-gold">ID Number: </h3></td>
            <td style:width="70px">><input type="text" name="cust_id" id="cust_id" value="${custDetail.cust_id}"/> <br/><br/>
            </td>
        </tr>
        <tr>
            <td><h3 class="templatemo-gold">Name: </h3></td>
            <td><input type="text" name="custName" id="custName" size="50" value="${custDetail.custName}"/> <br/><br/>
            </td>
        </tr>

        <tr>
            <td><h3 class="templatemo-gold">Address: </h3></td>
            <td><input type="text" name="custAdd" size="50" value="${custDetail.custAdd}"
                    /><br/><br/></td>
        </tr>
        <tr>
            <td><h3 class="templatemo-gold">Region: </h3></td>
            <td><input type="text" name="custRegion" id="custRegion" size="50" value="${custDetail.custRegion}"
                    /><br/><br/></td>
        </tr>
        <tr>
            <td>
        <tr><h3 class="templatemo-gold">Handphone No: </h3></td>
            <td><input type="text" name="custHandphoneNo" id="custHandphoneNo" size="50"
                       value="${custDetail.custHandphoneNo}"
                    /><br/><br/></td>
        </tr>
        <tr>
            <td><h3 class="templatemo-gold">Phone No: </h3></td>
            <td><input type="text" name="custPhoneNo" id="custPhoneNo" size="50" value="${custDetail.custPhoneNo}"
                    /><br/><br/></td>
        </tr>
        <tr>
            <td><h3 class="templatemo-gold">Email: </h3></td>
            <td><input type="text" name="custEmail" id="custEmail" size="50" value="${custDetail.custEmail}"
                    /><br/><br/></td>
        </tr>
        <tr>
            <td><input type="submit" name="submit" value="Update" action="CustomerController?action=edit"
                       class="btn text-uppercase templatemo-btn templatemo-info-btn"></td>
            <td><input type="submit" name="submit" value="Delete"
                       class="btn text-uppercase templatemo-btn templatemo-info-btn"></td>
        </tr>

    </table>
</form>

【问题讨论】：

绝对要做的第一件事：停止这样构建 SQL。使用带有参数化 SQL 的 PreparedStatement。您当前的方法极易受到 SQL 注入攻击。
可以在执行之前打印出sql查询吗？很可能它缺少报价或某事。并且还像 Jon Skeet 所说的那样使用 PreparedStatement :)
如何使用preparedStatement来执行查询？

标签： java oracle servlets dao

【解决方案1】：

您在这些行的结束引号后缺少逗号：

+ "custRegion = '"+cust.getCustRegion()+"' "
+ "custHandphoneNo = '"+cust.getCustHandphoneNo()+"' "
+ "custPhoneNo = '"+cust.getCustPhoneNo()+"' "

请改用PreparedStatement

【讨论】：

【解决方案2】：

您可以使用OraclePreparedStatement 并使用“名称”绑定变量

 OraclePreparedStatement statement = (OraclePreparedStatement)con.prepareStatement("UPDATE CUSTOMER "
                                        + " SET custName = :custName, "
                                        + " custAdd = :custAdd, "
                                        + " custRegion = :custRegion, "
                                        + " custHandphoneNo = :custHandphoneNo , "
                                        + " custPhoneNo = :custPhoneNo , "
                                        + " custEmail = :custEmail "
                                        + " WHERE cust_id = :cust_id ");

绑定变量。

statement.setStringAtName("custName",cust.getCustName());
statement.setStringAtName("custAdd",cust.getCustAdd());
statement.setStringAtName("custRegion",cust.getCustRegion());
statement.setStringAtName("custHandphoneNo",cust.getCustHandphoneNo());
statement.setStringAtName("custPhoneNo",cust.getCustPhoneNo());
statement.setStringAtName("custEmail",cust.getCustEmail());
statement.setStringAtName("cust_id",cust.cust_id());

执行查询

ResultSet rs = statement.executeQuery();

【讨论】：