例外com.mysql.jdbc.exceptions.MySQLSyntaxErrorException

Question

私のデータベースにいくつかのデータを追加しようとしていますが、com.mysql.jdbc.exceptions.MySQLSyntaxErrorExceptionというエラーが表示されます。 Main.java

で

AddToDatabase方法

public static void addToDatabaze(String name ,String address, String city, String phone, String email, String dateOfBirth, String age, String martialStatus, String gender, String id, String mainDepartment, String department, String training) throws ClassNotFoundException, SQLException 
{ 
    //Databaza 
    Class.forName("com.mysql.jdbc.Driver"); 
    String url="jdbc:mysql://***.*.*.*:****/employ"; 
    String uname="*****"; 
    String pass="***********"; 
    connect = DriverManager.getConnection(url,uname,pass); 
    Statement statement; 
    String query = "INSERT INTO employeetable (name,address,city,phone,email,dateofbirth,age,martialstatus,gender,id,maindepartment,department,training)values(" + name + "," + address + "," + city + "," + phone + "," + email + "," + dateOfBirth + "," + age + "," + martialStatus + "," + gender + "," + id + "," + mainDepartment + "," + department + "," + training + ")"; 
    statement = connect.createStatement(); 
    statement.execute(query); 
} 

AddNewEmployeeController.java

private Main main; 
    @FXML 
    private TextField nameField; 
    @FXML 
    private TextField addressField; 
    @FXML 
    private TextField cityField; 
    @FXML 
    private TextField phoneField; 
    @FXML 
    private TextField emailField; 

    @FXML 
    private DatePicker dateOfBirth; 
    @FXML 
    private TextField ageField; 
    @FXML 
    private ChoiceBox martialStatusBox; 

    @FXML 
    private RadioButton maleButton; 
    @FXML 
    private RadioButton femaleButton; 


    @FXML 
    private TextField idField; 
    @FXML 
    private ComboBox mainDepartmentBox; 
    @FXML 
    private ComboBox departmentBox; 
    @FXML 
    private CheckBox yesBox; 
    @FXML 
    private CheckBox noBox; 

@FXML 
    private void addButton() throws ClassNotFoundException, SQLException 
    { 
     if(yesBox.isSelected()) 
      { 
       main.addToDatabaze(nameField.getText(),addressField.getText(),cityField.getText(),phoneField.getText(),emailField.getText(),dateOfBirth.getValue().toString(),ageField.getText(),martialStatusBox.getSelectionModel().getSelectedItem().toString(),"Male",idField.getText(),mainDepartmentBox.getSelectionModel().getSelectedItem().toString(),departmentBox.getSelectionModel().getSelectedItem().toString(),"Yes"); 
       closeBtn(); 
      } 
    } 

OUTPUT：

Caused by: com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'Years,Single,Male,1404996,Electrical,Design,Yes)' at line 1 
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936) 
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2985) 
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1631) 
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1723) 
at com.mysql.jdbc.Connection.execSQL(Connection.java:3277) 
at com.mysql.jdbc.Connection.execSQL(Connection.java:3206) 
at com.mysql.jdbc.Statement.execute(Statement.java:727) 
at employee.Main.addToDatabaze(Main.java:58) 
at employee.view.AddNewEmployeeController.addButton(AddNewEmployeeController.java:164) 
... 118 more 

P.S.ここ

コードですメインます。java：はいで、

main.addToDatabaze(nameField.getText(),addressField.getText(),cityField.getText(),phoneField.getText(),emailField.getText(),dateOfBirth.getValue().toString(),ageField.getText(),martialStatusBox.getSelectionModel().getSelectedItem().toString(),"Male",idField.getText(),mainDepartmentBox.getSelectionModel().getSelectedItem().toString(),departmentBox.getSelectionModel().getSelectedItem().toString(),"Yes"); 

歳、独身、男性、1404996、電気、デザイン：

statement.execute(query); 

AddNewEmployeeController.java:164はこの行です：58は、この行である とき、私TextField ageField、ChoiceBox martialStatusBox、 "Male"、idField、ComboBox mainDepartmentBox、ComboBox departmentBox、 "Yes"にデータを追加しようとしました。あなたはprepared statementsを使用する必要が

Answer 1

：

try (PreparedStatement statement = connection.prepareStatement(
     "INSERT INTO employeetable (name,address,city,phone,email,dateofbirth,age,martialstatus,gender,id,maindepartment,department,training)" + 
     " values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"); 
    statement.setString(1, name); 
    statement.setString(2, address); 
    // ... etc for the other fields 

    statement.executeUpdate(); 
} 

あなたの元のコードの問題は、あなたが文字列値の前後に引用符を追加するのを忘れていることです。素朴な解決策は、それはまだ悪いですしかしnameが値O'Reillyを持っている場合、何が起こるかを推測するので、

"...('" + name + "','" + address + "'..." 

を使用することです。これはSQLインジェクションと呼ばれ、上記のようなプリペアドステートメントを使用することで簡単に避けることができても、最大のセキュリティ問題の1つです。