>>result = statement.executeQuery("SELECT password FROM terry
WHERE username =@@@@@");
just put it right in ;-)
result = statement.executeQuery("SELECT password FROM terry
WHERE username ="+InputUserName);
Just realise that executeQuery just takes in a String and you may compose Strings however way you want.
If InputUserName="cosi", then
"SELECT password FROM terry WHERE username="+InputUserName
equals
"SELECT password FROM terry WHERE username=cosi"
Only think you have to watch out for is you must encode your strings if you expect nonalphanumeric symbols. URLEncoder/URLDecoder is a cheap way to go about it...
An alternative strategy is to use PreparedStatements. (See
http://java.sun.com/j2se/1.4.2/docs/...Statement.html)
PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES
SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)
Hope this helps!
Ed