提交表单后出现 MySQL 语法错误

Question

我编写了一个简单的 java 代码来接受来自表单的参数并将其存储在一个表中。这是代码：

String fname = request.getParameter("username");
String mail = request.getParameter("email");
String country = request.getParameter("country");
String pword = request.getParameter("password");

Class.forName("com.mysql.jdbc.Driver");
Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/foodforthought", "root",
        "********");                                            
Statement statement = connection.createStatement();
try {
    int i = statement.executeUpdate("insert into users (username,email,country,password) values ("+fname+"','"+mail+"','"+country+"','"+pword+")");
    out.println("Successfully registered");
} catch (Exception e) {
    out.println(e);
    e.printStackTrace();
}  

Error:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'India',')' at line 1  

country 的值为India，来自表单。我该如何解决？

Answer 1

你的单引号是错误的。

但是永远不要使用从表单中读取的值插入到你的数据库中，你可能会遭受 SQL 注入

http://www.w3schools.com/Sql/sql_injection.asp

使用准备好的语句，将参数正确解析为特定类型

一个例子：

  String query = "insert into dept(deptnum, deptname, deptloc) values(?, ?, ?)";
  PreparedStatement pstmt = conn.prepareStatement(query); // create a statement
  pstmt.setInt(1, 1); // set input parameter 1
  pstmt.setString(2, "deptname"); // set input parameter 2
  pstmt.setString(3, "deptLocation"); // set input parameter 3
  pstmt.executeUpdate(); // execute insert statement

Answer 2

您忘记了查询中的' 字符：

("+fname+"','"+mail+"','"+country+"','"+pword+")
 ^ here                              and here ^

改成('"+fname+"','"+mail+"','"+country+"','"+pword+"')

或者最好使用PreparedStatement来避免这种错误和SQL注入问题。

String sql = "insert into users (username, email, country, password) values (?, ?, ?, ?)";
PreparedStatement preparedStatement = connection.prepareStatement(sql); 

// Insert values safe and indirectly to avoid mistakes and SQL injection
preparedStatement.setString(1, fname);
preparedStatement.setString(2, mail);
preparedStatement.setString(3, country);
preparedStatement.setString(4, pword);

// Perform the update
int count = preparedStatement.executeUpdate();