Java Servlet 中的 SQL 语法错误

Question

我尝试过这样做：

query1="INSERT INTO `users`(`email`, `password`, `login`, `familiya`, `name`, `otchestvo`, `age`, `country`, `city`, `mob`, `skype`) VALUES ("+user.getEmail()+","+user.getPassword()+","+user.getLogin()+","+user.getFamiliya()+","+user.getName()+","+user.getOtchestvo()+",11,"+user.getCountry()+","+user.getCity()+","+user.getMob()+","+user.getSkype()+")";

我做错了什么？所有“get”都不为空，只有语法错误。

我想发布数据库的图像，但我需要 10 个声望... 所有字段均为varchar(15)，年龄为int(2)

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '@mail.ru,12345,dima,Dmitriev,dima,Dmitrievich,11,Dmitrountry,Dmitriegrad,2020327' at line 1

Answer 1

在字符串值（varchar、文本等）周围加上单引号“'”

所以

String query1="INSERT INTO users(email, password, login, familiya, name, otchestvo, age, country, city, mob, skype) VALUES  ('"+user.getEmail()+"','"+user.getPassword()+"','"+user.getLogin()+"','"+user.getFamiliya()+"','"+user.getName()+"','"+user.getOtchestvo()+"',11,'"+user.getCountry()+"','"+user.getCity()+"','"+user.getMob()+"','"+user.getSkype()+"')";

不是字符串相关的类型不要得到单引号......

不过，更好的方法是使用 PreparedStatement，

String sql = "INSERT INTO users(email, password, login, familiya, name, otchestvo, age, country, city, mob, skype) VALUES  (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";

 try (PreparedStatement preparedStatement = con.prepareStatement(sql)) {
     preparedStatement.setString(1, user.getEmail);
     preparedStatement.setString(2, user.getPassword);
     preparedStatement.setString(3, user.getLogin());
     preparedStatement.setString(4, user.getFamiliya());
     preparedStatement.setString(5, user.getName());
     preparedStatement.setString(6, user.getOtchestvo());
     preparedStatement.setInt(7, 11);
     preparedStatement.setString(8, user.getCountry());
     preparedStatement.setString(9, user.getCity());
     preparedStatement.setString(10, user.getMob());
     preparedStatement.setString(11, user.getSkype());
     preparedStatement.executeUpdate();
}