SQL query : Wrong syntax

Question

I'm tring to write a query but I obtain a syntax error. I know that this error is in the query's syntax. This is the query

ResultSet set=statement.executeQuery("Select * from Ombrellone where PosizioneX='"+c.getX()+"',PosizioneY='"+c.getY()+"'" );

Anyone can help me?

Unrelated: you are wide open for SQL Injection. You should use a PreparedStatement — user330315
– user330315, Commented Oct 15, 2014 at 15:04
@a_horse_with_no_name Though it is not related, it's a bigger problem than the current problem :) — Suresh Atta
– Suresh Atta, Commented Oct 15, 2014 at 15:09

Community · Accepted Answer · 2017-05-23 12:20:28Z

5

If you want to have multiple conditions on select, you must use AND, not comma.

ResultSet set=statement.executeQuery("Select * from Ombrellone where PosizioneX='"+c.getX()+"' and PosizioneY='"+c.getY()+"'" );

Side note : Avoid using String concatination with query parameters. They causes SQL injections and try using PreparedStatement.

edited May 23, 2017 at 12:20

CommunityBot

11 silver badge

answered Oct 15, 2014 at 15:03

Suresh Atta

122k38 gold badges206 silver badges315 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 12:20:28Z

1

Though the problem in your case was basically because you used comma on your SQL query which is wrong you can use AND or OR for condition fulfillment when using WHERE clause but also I would suggest you to use PreparedStatement over Statement.

String query = "Select * from Ombrellone where PosizioneX = ? and PosizioneY = ?"
PreparedStatement statement = conn.prepareStatement(query);
statement.setString(1,c.getX());
statement.setString(2,c.getY());
ResultSet resultSet = statement.executeQuery();

Refer difference between statement and preparedstatement

edited May 23, 2017 at 12:20

CommunityBot

11 silver badge

answered Oct 15, 2014 at 15:12

SparkOn

8,9665 gold badges31 silver badges36 bronze badges

2 Comments

Brandon Over a year ago

PreparedStatement is definitely the better choice here, however, strictly speaking, is secondary to the problem. The problem was the use of comma instead of and.

SparkOn Over a year ago

@Brandon agreed but the solution should always be perfect

Collectives™ on Stack Overflow

SQL query : Wrong syntax

2 Answers 2

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related