Inserting Integer Values into MySQL Database using Variables

Question

     Class.forName("com.mysql.jdbc.Driver");
     Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/test",
     "root", "mysecret");
     System.out.println("Connected to Database");
     Statement stmt1 = conn.createStatement();
     ResultSet rs1=null;
     String sql="insert into id
     values('"+name+"',12,+fs+,+se+,+th+,+ft+,+f+,+si+,+sv+,+ei+)";
     System.out.println("sql:"+sql);
     stmt1.executeUpdate(sql);

The Name Variable is taken care of in the definition part not included here, the output is

     sql:insert into id values('Golum',12,+fs+,+se+,+th+,+ft+,+f+,+si+,+sv+,+ei+);

It also says error in SQL Syntax which refers to the variables fs,se,th,ft,f,si,sv and ei. Basically i am trying to pass integers to MySQL Database using variables. the definition of these variables is as such

    int fs = x21;
    int se = y21;

x21 and y21 store mouse click co-ordinates x and y respectively. The code below shows that the co-ordinates are passed correctly. The error is in SQL Syntax. I wanna Know what is the correct syntax for passing integers to SQL Database using this technique.

    System.out.println(fs);

rgettman · Accepted Answer · 2013-03-26 19:04:31Z

3

You have a SQL error in your insert statement. I don't know why you have those + characters in your statement, but I'm guessing that you are attempting to concatenate the values into the statement. But in your attempt the + characters are part of the string. Try inserting double-quote characters to end and start the strings to concatenate together to form the insert statement:

String sql="insert into id values('"+name+"',12, " +
    fs+","+se+","+th+","+ft+","+f+","+si+","+sv+","+ei+")";

Of course anytime you concatenate values that may be from the user into a SQL statement, you are vulnerable to SQL injection. If these are user values, then use a PreparedStatement with bind variables instead.

answered Mar 26, 2013 at 19:04

rgettman

179k30 gold badges282 silver badges365 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

HeatfanJohn · Accepted Answer · 2013-03-26 19:04:19Z

0

You need to tell Java to convert your integer variables to strings, change your sql assignment statement to:

String sql="insert into id values('"
    + name + "',12," + fs + ", " + se + ","
    + th + "," + ft + "," + f + "," + si + "," + sv + "," + ei + ")";

answered Mar 26, 2013 at 19:04

HeatfanJohn

7,3732 gold badges38 silver badges42 bronze badges

Comments

msfk · Accepted Answer · 2013-03-26 19:06:23Z

0

try this

String sql="insert into id values('"+name+"',12,"+fs +","+se+","+th+","+ft+","+f+","+si+","+sv+","+ei+")";

your syntax for using vars in the string is wrong. The vars should be out of quotations

answered Mar 26, 2013 at 19:06

msfk

1371 silver badge15 bronze badges

Collectives™ on Stack Overflow

Inserting Integer Values into MySQL Database using Variables

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related