Exception caught : java.sql.SQLException: Incorrect integer value: [closed]

Question

Error:

Exception caught : java.sql.SQLException: Incorrect integer value: '[Ljava.lang.String;@26fd19c6' for column 'dedId' at row 1 The database could not be connected

Program:

public void updateDeduction(int empId, String[] dedId, String dedName, String dedDate, String dedAmount) throws SQLException{
    stmt = conn.createStatement();
    String updateString="INSERT INTO deductions (empId,dedId,dedName,dedDate,dedAmount) VALUES (";
    updateString +="'"+empId+"', ";
    updateString +="'"+dedId+"', "; 
    updateString +="'"+dedName+"', ";
    updateString +="'"+dedAmount+"', ";
    updateString +="CURDATE())" ;
    stmt.executeUpdate(updateString); 
    return;
}

Little Bobby Tables alert! - don't concatenate together your SQL statements - that's just asking for trouble.... — marc_s
– marc_s, Commented Jan 16, 2013 at 19:46

Jim Garrison · Accepted Answer · 2013-01-17 07:36:37Z

2

Parameter dedid is an array of strings. When you executed

updateString +="'"+dedId+"', ";

it was converted to the string [Ljava.lang.String;@26fd19c6.

You need to figure out which of the array elements you want to use.

As others have commented, building a statement by concatenating user-provided text like this is a sure way to get hacked via SQL Injection. You should be using PreparedStatement instead, with placeholders, i.e.

INSERT INTO deductions (empId,dedId,dedName,dedDate,dedAmount) VALUES (?,?,?,?,?)

answered Jan 17, 2013 at 7:36

Jim Garrison

87k20 gold badges162 silver badges196 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

ldam Over a year ago

With regards to SQL injection and using PreparedStatment, will it automatically strip out any unsafe characters or is that still left up to the programmer?

Jim Garrison Over a year ago

The presence of "unsafe characters" is immaterial as the values do not get substituted into the SQL literal. They go directly into the text value and cannot modify the SQL.

Collectives™ on Stack Overflow

Exception caught : java.sql.SQLException: Incorrect integer value: [closed]

1 Answer 1

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Linked

Related