Syntax Error with mysql in java

Question

I don' t understand why eclipse tell me this error for this query:

ResultSet rs = st.executeQuery("select * from '"+ value3+ "' where Name='" + value1 + "' and Password='"+ value2 + "'");

error:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''f' where Name='f' and Password='f'' at line 1

1. Use backticks to escape table and column names. 2. Use prepared statements instead of patching thinks together. — juergen d
– juergen d, Commented Jan 18, 2014 at 16:43
be careful though. concatenating sql statements like that can lead to SQL injection vulnerarbilities. have a look at prepared statements. — kmera
– kmera, Commented Jan 18, 2014 at 16:44
why suffer using above statement try using PreparedStatement lot more easier to understand and better way of coding. — praveen_mohan
– praveen_mohan, Commented Jan 18, 2014 at 16:48

peter.petrov · Accepted Answer · 2014-01-18 16:58:43Z

3

1) Try this.

ResultSet rs = st.executeQuery("select * from `" + value3 + "` where Name='" +
               value1 + "' and Password='"+ value2 + "'");

See here:
MySQL Identifiers

The identifier quote character is the backtick ("`") in MySQL.

2) Also, as you're not using PreparedStatement, if your Name or
Password contains ' you will have issues. Your code is vulnerable
to SQL injection.

See also:
PreparedStatement
SQL injection

edited Jan 18, 2014 at 16:58

answered Jan 18, 2014 at 16:42

peter.petrov

39.6k23 gold badges114 silver badges193 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

Sirko Over a year ago

Some explanation, what you actually changed and why you did so, would be nice as well.

OiRc Over a year ago

you are only the BEST, i' ve passed all the afternoon to get some solution!!! tnks you so much!!!

OiRc Over a year ago

i dont understand when you talk about sql injection can you explain pretty well?

peter.petrov Over a year ago

Well, you can Google it. Check this for example: en.wikipedia.org/wiki/SQL_injection

jmsalcido Over a year ago

let me understand, if it is a school project it will have sql injection but if it is for your real job it would not have security flaws?, CiMat, always do the best when programming please. :)

|

Collectives™ on Stack Overflow

Syntax Error with mysql in java

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related