Develop Reference

MySQL Java prepared statement Syntax error

I need to select rows from mysql table based on various criteria, for example Colour= Black, or size= L.
The code works without the preparedstatement and the question marks, but whenever I attempt to use the question marks the code does not run.
I have read something about typing the question mark like \'?'// but I am not sure about the exact format.
String URL = "jdbc:mysql://localhost:3306/clothing";
String USERNAME = "root";
String PASSWORD = "password";
Connection con = DriverManager.getConnection(URL, USERNAME, PASSWORD);
Statement stmt = con.createStatement();
String sql= "SELECT * FROM clothing.Lostandfound WHERE Colour = ? AND Size = ?;";
ResultSet rs = stmt.executeQuery(sql);
PreparedStatement preparedStmt = con.prepareStatement(sql);
preparedStmt.setString(1, Data1);
preparedStmt.setString(2, Data2);
Also, Size is written out in orange colour, but the error happens also when I only use this sql String
String sql= "SELECT * FROM clothing.Lostandfound WHERE Colour = ?;";
I have looked at like 20 different answers, but didnt find anything helpful, so thanks in advance for any help!

You are executing the query using a normal java.sql.Statement, not using a java.sql.PreparedStatement. This won't work because a normal Statement does not support parameterized queries. So, remove the creation and execution of the Statement, and make sure you execute the statement using the PreparedStatement:
String URL = "jdbc:mysql://localhost:3306/clothing";
String USERNAME = "root";
String PASSWORD = "password";
String sql= "SELECT * FROM clothing.Lostandfound WHERE Colour = ? AND Size = ?;";
try (Connection con = DriverManager.getConnection(URL, USERNAME, PASSWORD);
PreparedStatement preparedStmt = con.prepareStatement(sql)) {
preparedStmt.setString(1, Data1);
preparedStmt.setString(2, Data2);
try (ResultSet rs = preparedStmt.executeQuery()) {
// process result set
}
}
Also note the addition of try-with-resources, which will ensure connections, statements and result sets are closed correctly.

Moving jdbc connection to property files in JSP

I am bit new to JSP and JDBC, I want to know how to move a JDBC connection like below to a property file for example to test.properties
Class.forName("oracle.jdbc.driver.OracleDriver");
//Connection conn = DriverManager.getConnection("jdbc:oracle:thin:#nyvm0467.ptc.un.org:1521:EIDMSUAT", "DBO_EIDMSUAT", "NewPassDBO_EIDMSUAT");
Connection conn = DriverManager.getConnection("jdbc:", "ROD", "DMSP");
Statement statement = conn.createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE,ResultSet.CONCUR_READ_ONLY );
String queryString = "select area from helparea order by area";
ResultSet rs = statement.executeQuery(queryString);

One of the possibilities is as follows. correct me if I am wrong
ResourceBundle resource = ResourceBundle.getBundle("C:\\Users\\S.Mandava\\workspace2\\Contactus\\src\\OIMConnection");
String name=resource.getString("dbname");
String surname=resource.getString("dbpassword");
Class.forName("oracle.jdbc.driver.OracleDriver");
Connection conn2 = DriverManager.getConnection("jdbc:oracle:thin:#eidms-db-003.un.org:1521:EIDPMDM", resource.getString("dbname"), resource.getString("dbpassword"));
Statement statement2 = conn2.createStatement( ResultSet.TYPE_SCROLL_INSENSITIVE,ResultSet.CONCUR_READ_ONLY );
String queryString2 = "select area from helparea order by area";
ResultSet rs2 = statement2.executeQuery(queryString2);

Java Mysql Prepared statement syntax issue

I am getting a syntax error with the SQL code within a prepared statement. I have read the other answers on the site and I cannot work out the issue. My code is as follows
private boolean validate_login(String username,String password) {
try{
Class.forName("com.mysql.jdbc.Driver"); // MySQL database connection
String url = "jdbc:mysql://localhost/db_webstore";
String user = "root";
String pw = "Password";
String SQL = "select * from tbl-users where Tbl-UsersUserName=? and Tbl-UsersPassword=?";
Connection conn = DriverManager.getConnection(url, user, pw);
PreparedStatement pst;
pst = conn.prepareStatement(SQL);
pst.setString(1, username);
pst.setString(2, password);
ResultSet rs = pst.executeQuery();
if(rs.next())
return true;
else
return false;
}
catch(Exception e){
e.printStackTrace();
return false;
}
}
The error message is as follows
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-users where Tbl-UsersYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '-users where Tbl-Users
Can anyone offer some advice? Thanks in Advance

You are probably missing some dots in your query. Table and column name need to be separated by a dot. Furthermore the table name needs to be quoted as - is not allowed in unquoted identifiers (see here):
String SQL = "select * from `Tbl-Users`"
+ " where `Tbl-Users`.UserName=?"
+ " and `Tbl-Users`.Password=?";
UPDATE:
Added link to MySQL docu on valid identifiers
Quoted table name using `

you should include the port number(which is 3306 for MySQL) in your database connection
accordingly your code should be corrected as follows
private boolean validate_login(String username,String password) {
try{
Class.forName("com.mysql.jdbc.Driver"); // MySQL database connection
String url = "jdbc:mysql://localhost:3306/db_webstore";
String user = "root";
String pw = "Password";
String SQL = "select * from tbl-users where Tbl-UsersUserName=? and Tbl-UsersPassword=?";
Connection conn = DriverManager.getConnection(url, user, pw);
PreparedStatement pst;
pst = conn.prepareStatement(SQL);
pst.setString(1, username);
pst.setString(2, password);
ResultSet rs = pst.executeQuery();
if(rs.next())
return true;
else
return false;
}
catch(Exception e){
e.printStackTrace();
return false;
}
}

How do I verify password entered is the password associated with entered email?

Hey I am trying to verify the password matches the one they entered with the email I have been searching for the web for a few hours and everything else I have tried does not work this is what i have so far:
try {
Class.forName(driver).newInstance();
Connection conn = (Connection) DriverManager.getConnection
(url + dbName, userName, password);
PreparedStatement checkUserInfo = (PreparedStatement) conn.prepareStatement
("SELECT password FROM profiles WHERE email = ?");
checkUserInfo.setString(1, emailT); //emailT is email pulled from an editText
//checkUserInfo.setString(2, pass1);
//Statement state = (Statement) conn.createStatement();
//String querychk = "SELECT * FROM profiles WHERE email = '"+emailT+"'";
//ResultSet rs = state.executeQuery(querychk);
ResultSet rs = checkUserInfo.executeQuery();
while (rs.next()){
String pass = rs.getString(2);
if (pass.equals(pass1)) {
return success;
}
}
conn.close();
}
catch (Exception e) {
e.printStackTrace();
}

Simply modify your SQL Query to:
"select * from profiles where email=? and password=?"
And be-aware to validate input fields for preventing from SQL injection
And for getting PreparedStatement object or Connection object, you don't have to externally typecast it, cause it is returning the same object as you assigning to it. Even java doc also provided the below statement for the PreparedStatement
PreparedStatement pstmt = con.prepareStatement(Query);

Eclipse Compiler error saying connection variable cannot be resolved to a type

this is a Java Code i wrote in Eclipse to retrieve information from a MySQL Database.. But the Compiler is giving an error saying conn cannot be resolved to a type.. can anyone pls tel me what i may be doin wrng??
import java.sql.*;
public class plh {
static Connection conn=null;
static Statement s=null;
public static void main(String[] args){
try {
Class.forName("com.mysql.jdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/wonkashop","root", "");
String st= new String("select * from users;");
s= new conn.createStatement(st);//ERROR.. why??
}
catch (Exception e) {
System.out.println("Unable to connect to Database");
}
}
}

Here in the line
s= new conn.createStatement(st);//ERROR.. why??
there is no need for new keyword
like
Class.forName("com.mysql.jdbc.Driver");
conn = DriverManager.getConnection(credentials);
stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(st);

I had the same issue, and surfing by Internet triying to get a solution without successful I put these imports and it works for me.
import java.sql.*;
import java.sql.Connection;
import java.sql.DatabaseMetaData;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
I hope this can help more people.

Remove the new keyword from your line of code. You need to get the Statement as :
s= conn.createStatement(); // createStatement doesn't take a String argument
DriverManager.getConnection() already returns a Connection object , which you have referenced by the identifier conn , hence use it to get the Statement .
If you want to pass the sql query string , use a PreparedStatement instead of a Statement.
That is Connection#prepareStatement(sql).
Statement :
final String st= "select * from users;";
Statement s = conn.createStatement();
ResultSet rs = stmt.executeQuery(st);
PreparedStatement:
final String st= "select * from users;";
PreparedStatement preparedStatement = conn.prepareStatement(st);
ResultSet rs = preparedStatement.executeQuery();

change this line
s= new conn.createStatement(st);//ERROR.. why??
to
s= conn.createStatement();
Connection#createStatement
Returns a new default Statement object.

Just conn.createStatement();. Don't put new here, because you're not instantiating a class.
You should only write new before the name of a class, because it creates an object of that class. But here, conn is not the name of a class - it's just the name of a variable that references an existing object of some class.

try {
Class.forName("com.mysql.jdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/wonkashop", "root", "");
st= "select * from users";
s = conn.createStatement();// fixed
ResultSet rs = s.executeQuery(st);
while(rs.next()){
//Retrieve by column name
int id = rs.getInt("id");
String name = rs.getInt("name");
}
}