Question

I am writing the following SQL query in my Java program

PreparedStatement pre = conn.prepareStatement("select ID,FirstName,LastName,Dept from "                 
    + "student where ID =" + ID + " or FirstName=" + firstName + ";");

However, I am getting the following error:

use the right syntax for FirstName=”+Parker

How is this caused and how can I solve it?

Answer 1

You should take advantage of prepared statements by making use of prepared statements parameters. This way, you can set your parameters pragmatically using setters.

http://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html.

Here is a snippet from the Oracle docs:

PreparedStatement updateSales = null;

String updateString = “update ” + dbName + “.COFFEES ” + “set SALES =
? where COF_NAME = ?“;

updateSales = con.prepareStatement(updateString);

updateSales.**setInt**(1, e.getValue().intValue());

updateSales.**setString**(2, e.getKey());

Just make sure you set the statements *in order a*s the sql query.