Question

how can i replace hardcoded number with variable in this java statement which is accessing the mysql datatabase using jdbc. the query is executed using executeQuery(query)

here is the java statement

String query = "select * from TableA where num = '1233' ";

i need to replace this 1233 with a variable in this statement.

any help appreciated

Regards,

Answer 1

If you can use prepared statement, you’ll be safer (no risk of SQL injection):

    Connection con = getMyConnection();
    try {
        PreparedStatement ps = con.prepareStatement("select * from TableA where num = ?");
        try {
            ps.setLong(1, number);
            ResultSet rs = ps.executeQuery();
            while(rs.next()) {
                //TODO
            }
        } finally {
            ps.close();
        }
    } finally {
        con.close();
    }