ansaurus

Question

Answer 1

+2 A:

the problem is here:

java.sql.ResultSet rslt = stmt.executeQuery(" SELECT * FROM student where rno = nrno");

this results in passing a string SELECT * FROM student where rno = nrno to sqlServer which is not what you want.

you can change it as specified by Richie to

`java.sql.ResultSet rslt = stmt.executeQuery (" SELECT * FROM student where rno =" +` nrno);

Or better use parametrised call as the first approach may be prone to sql Injection

PreparedStatement st = conn.prepareStatement(
            "SELECT * FROM student where rno = ?");
        st.setInt(1, nrno);

In your case you are parssing nrno to int so probably there is no issue with sql injection but it is saver to user parametrised approach anyway (say the parameter type changes to string in some future release)

kristof 2009-11-09 12:22:41

+1 for parameterised queries (could we have a quick example?). Building query strings with literal values from variables isn't a good idea!

bobince 2009-11-09 13:20:25

thanks for the comment bobince, updated my answer to add the code example.

kristof 2009-11-09 14:43:10

Answer 2

+2 A:

java.sql.ResultSet rslt = stmt.executeQuery(" SELECT * FROM student where rno = nrno");

You might want to change that to

java.sql.ResultSet rslt = stmt.executeQuery (" SELECT * FROM student where rno =" + nrno);

coz "nrno" is a variable..

Hope this helps you out...

cheers,

RDJ

Richie 2009-11-09 12:44:04

ansaurus

tags:

views:

answers:

select value from sqlserver problem

related questions