Question

I am in trouble with select query

ResultSet rs = stmt.executeQuery("SELECT * FROM blogs where id in(select id from blogers where name=\"" + businessName + "\" ) order by postdate DESC limit " + i + "," + j);

as in my blogers table some records have name like rah’s, tetra!’t’ so this query is not returning me records
what’s wrong here ?

Answer 1

what’s wrong here

You’re including your values directly in the SQL. Don’t do that. Use parameterized SQL instead, via a PreparedStatement.

That way:

• You don’t need to worry about performing any escaping
• You don’t need to worry about SQL injection attacks
• You don’t need to worry about conversion issues for dates and times etc
• You separate your code from your data (your SQL will be easier to read, and
  can be extracted to separate resource files if you want, as it will be constant)