Dynamic variable in executeUpdate (Java)

Question

I have the following connection, statement and executeUpdate

Connection con = DBConnPool.getInstance().getConnection();
Statement stmt = con.createStatement();

//String str1 = "update node set compareflag=0, personalid=NULL where ipaddress='192.168.150.213'";

String str1 = "update node set compareflag=0, personalid=NULL where ipaddress='var3.getIpAddress()'";
                            stmt.executeUpdate(str1);

The commented out String line works perfectly, the other one ignores the value returned by var3.getIpAddress() even though that variable does contain the correct data which I use in other areas of my code.

Do I have to create a separate variable first and then equate it to var3.getIpAddress() ?

Any thoughts appreciated, it's probably insufficient " or " in the wrong place.

Start here. You can't invoke Java methods from a portion of String literal. — Mena
– Mena, Commented Oct 8, 2018 at 15:50

Elliott Frisch · Accepted Answer · 2018-10-08 16:00:10Z

3

Prefer a PreparedStatement with a bind parameter. Dynamically building a query leaves you vulnerable to SQL Injection attacks. PreparedStatement (when used correctly) is immune to SQL Injection. It also makes the code easier to read and reason about. For example,

Connection con = DBConnPool.getInstance().getConnection();
String qry = "update node set compareflag=0, personalid=NULL where ipaddress=?";
PreparedStatement stmt = con.prepareStatement(qry);
stmt.setString(1, var3.getIpAddress());
stmt.executeUpdate();

answered Oct 8, 2018 at 16:00

Elliott Frisch

202k20 gold badges166 silver badges265 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Robert Kock Over a year ago

OK but you may consider using variables also for the other columns being updated.

Ralph Over a year ago

Thanks for all replies, much appreciated.

Mark Rotteveel Over a year ago

@RobertKock There is no reason to do that if those values are fixed.

Huy Nguyen · Accepted Answer · 2018-10-08 16:54:38Z

3

You should use PreparedStatement to set parameter for safe.

PreparedStatement pstmt = con.prepareStatement("update node set compareflag=0, personalid=NULL where ipaddress=?");
pstmt.setString(1,var3.getIpAddress());
pstmt.executeUpdate();

edited Oct 8, 2018 at 16:54

answered Oct 8, 2018 at 15:58

Huy Nguyen

2,0611 gold badge12 silver badges11 bronze badges

3 Comments

Robert Kock Over a year ago

OK but you may consider using variables also for the other columns being updated.

Elliott Frisch Over a year ago

The last line is incorrect. pstmt.executeUpdate(str1); invokes the method from Statement.executeUpdate(String) (where str1 is a query and the previously bound query and parameter are ignored).

Mark Rotteveel Over a year ago

@ElliottFrisch Even stronger executeUpdate(String) on a PreparedStatement should always throw a SQLException, that is required by the JDBC specification.

Collectives™ on Stack Overflow

Dynamic variable in executeUpdate (Java)

2 Answers 2

3 Comments

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related