Question

I am getting SQL syntax error in the following code snippet. What is the problem here? I am unable to figure it out. Please help.

String selectSQL = "SELECT * FROM cost_info where `date` > ? and `date` < ?  order by `date`";
        PreparedStatement preparedStatement = conn.prepareStatement(selectSQL);

        java.sql.Date sqlFromDate = java.sql.Date.valueOf(from_date);
        java.sql.Date sqlEndDate = java.sql.Date.valueOf(end_date);

        preparedStatement.setDate(1, sqlFromDate );
        preparedStatement.setDate(2, sqlEndDate );
        rs = preparedStatement.executeQuery(selectSQL);

I am using MySQL. Error is:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? and `date` < ?  order by `date`' at line 1
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:411)
at com.mysql.jdbc.Util.getInstance(Util.java:386)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:1052)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3597)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3529)
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1990)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2151)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2619)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2569)
at com.mysql.jdbc.StatementImpl.executeQuery(StatementImpl.java:1521)
at com.source.viralmo.rms.CostDisplay.initialize(CostDisplay.java:77)
at com.source.viralmo.rms.CostDisplay.<init>(CostDisplay.java:34)
at com.source.viralmo.rms.AdminPage.actionPerformed(AdminPage.java:141)

Answer 1

First, order by should go after where.

Second, if you are using MySQL, date should be quoted since it’s a reserved word for the DATE type. The query should be:

SELECT * FROM cost_info where `date` > ? and `date` < ?  order by `date`

Third, prepared statements are executed with the executeQuery() method. The executeQuery(String) method that is being used here is for executing normal statements; for example it doesn’t substitute parameters so the ? is passed as-is to the database. You need:

rs = preparedStatement.executeQuery(/* empty */);