sql syntax error MySQLSyntaxErrorException

Question

String sql = "INSERT INTO order " + "(customerid, pant, shirt, date) " 
  + "VALUES ('"  + jTextField1.getText() + "','" + jTextField2.getText() 
  + "','" + jTextField3.getText() + "','" + jTextField4.getText() + "')";

When tried this, I got the following error:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; 
    check the manual that corresponds to your MySQL server version for the right syntax to use near 
    'order (customerid, pant, shirt, date) VALUES ('10','2','3','26')' at line 1
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method).

This code is just begging for a SQL injection attack. Do not use string concatenation for SQL, use PreparedStatements and query parameters for the love of humanity. — brettw
– brettw, Commented Nov 26, 2013 at 14:53

juergen d · Accepted Answer · 2016-08-10 21:50:58Z

4

You need to escape reserved words like order with backticks

INSERT INTO `order` (customerid, ...

Besides that I recommend using Prepared Statements.

edited Aug 10, 2016 at 21:50

answered Nov 26, 2013 at 12:14

juergen d

205k40 gold badges303 silver badges377 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Sadikhasan · Accepted Answer · 2013-11-26 12:17:52Z

0

Table name "order" is reserve word so please change table name and try it.

answered Nov 26, 2013 at 12:17

Sadikhasan

18.6k23 gold badges84 silver badges126 bronze badges

Collectives™ on Stack Overflow

sql syntax error MySQLSyntaxErrorException

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related