Question

I have html file as String and I want to insert it into MySQL DB, using update query. I tried this:

Statement st = connection.createStatement();
String query = "UPDATE orders SET status='ready', html='"+html+"' WHERE id='123'";
int num = st.executeUpdate(query);

But I get following exception:

MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'zglosBladWindow').ck_window.showCenter('this');" href="#">zg?o? b??d na stronie<' at line 1

This is somwhere inside HTML – probably I cant just quote html with "" and insert it as it contains many special characters and quotes also – so how I can insert it? Should I encode it somehow?

Answer 1

I’d advice you to use PreparedStatement rather than Statement.

String query = "UPDATE orders SET status=?, html=? WHERE id=?";
PreparedStatement stmnt = conn.PreparedStatement(query);
stmnt.setString(1, yourtext);
....
int num = st.executeUpdate();