Question

I am a Programmer learner.

I want to get MySQL query in following format

 select status from training where status in ("Open", "Delivered")

from my code

if(params.openCheckBox){
    query +=" ( t.status  IN ("+params.openCheckBox+", "+params.DeliveredCheckBox+")" 
    query +=" )"
}

but it gives

   select status from training where status in (Open, Delivered)

Here “” (double quote is missing)

Answer 1

escape double quotes with \, MySQL Accepts double quotes to wrap strings.

query +=" ( t.status  IN (\""+params.openCheckBox+"\", \""+params.DeliveredCheckBox+"\")" 
query +=" )"

or
just use single quote

query +=" ( t.status  IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')" 
query +=" )"

the query above is vulnerable with sql injection. make use of PreparedStatement like the one below

Code Snippet:

dbConnection = getDBConnection();
String query = "SELECT .... FROM .... WHERE t.status IN (?, ?)";
PreparedStatement preparedStatement = dbConnection.prepareStatement(query);
preparedStatement.setString(1, params.openCheckBox);
preparedStatement.setString(2, params.DeliveredCheckBox);
ResultSet rs = preparedStatement.executeQuery();

SOURCES

• PreparedStatement
• JDBC PreparedStatement Example