Unable to create database using prepared statements in MySql

Question

I am trying to create the database using a prepared statement in MySQL. Here I am passing the parameters as shown.

PreparedStatement createDbStatement = connection.prepareStatement("CREATE DATABASE ?");
createDbStatement.setString(1, "first_database");
createDbStatement.execute();
connection.commit();

But I am getting a syntax error. Is it possible to create tables and databases using prepared statements?

Mureinik · Accepted Answer · 2014-10-27 07:25:27Z

14

in a PreparedStatement can only be used to bind values (e.g., in where conditions on in values clauses), not object names. Therefore, you cannot use it to bind the name of a database.

You could use string manipulation to add the database name, but in this case, there's really no benefit in using PreparedStatements, and you should just use a Statement instead:

String dbName = "first_database";
Statement createDbStatement = connection.createStatement();
createDbStatement.execute("CREATE DATABASE " + dbName);

answered Oct 27, 2014 at 7:25

Mureinik

316k54 gold badges400 silver badges405 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

mehmetseckin Over a year ago

Nice answer, but i have a question; Should dbName be validated here manually?

Mureinik Over a year ago

This is a "skeleton" answer - you should probably add some input sanity/validation here if you get the dbName from user input.

mehmetseckin Over a year ago

I know, I just wondered if Statement.execute() method does any validation for the input query; or it just sends the query without any validation. Thanks.

Mureinik Over a year ago

It just sends it to the databsae

Collectives™ on Stack Overflow

Unable to create database using prepared statements in MySql

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related