insert data into database with jsp

Question

i have to inser data from a form into DB, i tried this code it was work but now it doesnt work. i want to know where is the problem with this code

this is the code

Connection con =null;

    try{


        String driveName = "com.mysql.jdbc.Driver";


        Class.forName(driveName).newInstance();



        } catch(java.lang.ClassNotFoundException e) {
        System.err.print("ClassNotFoundException: ");
        System.err.println(e.getMessage());
        }
        try{
        con = DriverManager.getConnection("jdbc:mysql://localhost:3306/onlinequiz","root","root");
       Statement statement =con.createStatement();


    //  int id=Integer.parseInt(request.getParameter("T1"));
       int quizID = Integer.parseInt(request.getParameter("quizID"));

String take2=request.getParameter("question_type"); String course=request.getParameter("course"); String level=request.getParameter("level");

int duration=Integer.parseInt(request.getParameter("duration"));

String Title=request.getParameter("Title"); String Description=request.getParameter("Description");

statement.executeUpdate("insert into quiz (course,Tiltle,Description,quizID,question_type,duration,level) values('"+course+"','"+Title+"','"+Description+"','"+quizID+"','"+take2+"','"+duration+"','"+level+"')");

 %>
<%



        statement.close();



    } catch ( Exception e ) {
        out.println( "Exception: " + e.getMessage() );
    }
        // execute the statements even if the exception occurs
        finally{

        }
        %>

i tried and edit this code and its work, i made some changes , i want according what the user choose in the question type which is drop down box that conatain multiple choice or true false , should i write if statement that forward the user to his choice.

Answer 1

Does the code above throw an exception when it is executed? If so, can you copy/paste the exception message in the post?

Also, you should not directly add the user input to your insert query, it is prone to SQL injection attacks. Use prepared statements instead and consider using a proper Model-View-Control architecture by using a data access layer for all database transactions.