Question

I am getting invalid column index for following prepared statement.
Here is my code

// Excluding some unnecessary code
counter = 1;
if (rsTableNames.next()) 
{
    // Creating Query for prepared statement
    String getCode = "select * from ( select c_name from " 
          + rsTableNames.getString(1)+ " where lower(c_name) like ?%'";
    while (rsTableNames.next()) 
    {
      getCode += " union select c_name from " + 
      rsTableNames.getString(1)+ " where lower(c_name) like ?%'";
      counter++;
    }
    getCode += " ) where rownum <= " + maxRecords;
        // Now  The getCode contains 3 place holders ie ?           
    pst = con.prepareStatement(getCode);
    String param = "'" + query.toLowerCase();

    for(int i=1;i<=counter;i++)
    {
        pst.setString(i,param);  // when i=3 exception is thrown
    }
}

I am getting the exception when i becomes 3 though the query contains 3 place holders.
EDIT (HINT): I think the problem is with the ' which is creating havoc. How can we escape it?

Answer 1

I don’t know whether it’s the cause of the problem, but I don’t think parameters work quite the way you think they do when it comes to quoting. You’re still adding quotes in your code after each parameter and as the start of your parameter. I suspect you just want:

rsTableNames.getString(1)+ " where lower(c_name) like ?";

in each place, then:

String param = query.toLowerCase() + "%";

It’s possible that due to quote parsing, this will fix the issue – I think your middle parameter is being deemed to be part of a big literal.