String Usage in java

Question

Consider am assigning the URL in the code below to a string, say

String link = "http://www.topix.com/rss/city/ellensburg-wa";

How should I use the string in the below code instead of the URL itself.

Note: am a beginner in java

 stmt.executeQuery("select url from urls where url='http://www.topix.com/rss/city/ellensburg-wa'");

 stmtR.executeUpdate("insert into urls values(21211,'http://www.topix.com/rss/city/ellensburg-wa','source',1,0)"

Answer 1

You can do that like this:

stmt.executeQuery("select url from urls where url='"+link+"'");

Answer 2

stmt.executeQuery("select url from urls where url='" + link + "'");

stmtR.executeUpdate("insert into urls values(21211,'" + link + "','source',1,0)"

+ is Java's string concatenation operator.
See: http://download.oracle.com/javase/1.4.2/docs/api/java/lang/String.html

---

ATTENTION!!

You should really consider using prepared statements (see other answers) if you are going to use this for SQL queries.

Answer 3

If you want to create a nice query use a prepared statement

PreparedStatement insertUrlStatement = con.prepareStatement("INSERT INTO urls VALUES(?, ?, ?, ?)");
//Replace the **first** "?" by an "id" variable content (containing an **int**)
insertUrlStatement.setInt(1, id);
//Replace the **second** "?" by the "url" variable content (containing a **String**)
insertUrlStatement.setString(2, url);
//Two other setXxx();
insertUrlStatement.executeUpdate()

Answer 4

I've got to give my 2p on this one.

NEVER EVER Use string concatenation and SQL.

(ok that should perhaps read as never use sting concatenation and user input)

Follow the advice given above about using prepared statements.

Think about what would happen if you used string concatenation and SQL, when some nasty user enters the link

x'; DROP TABLE urls; --

Your code would look like

stmt.executeQuery("select url from urls where url='x'; DROP TABLE urls; --'");

Seriously don't even write a prototype that does this, bad code is always bad code and will end up being used. You don't want to be fired for writing one of the top ten vulnerabilities do you? www.drdobbs.com/web-development/224400744

Goto this site for a lot more examples and reasons why SQL string concatenation is BAD http://unixwiz.net/techtips/sql-injection.html