Please help with JSP mysql update query

[cacorat]

Submit Question

<%
String questionin = request.getParameter("questionin");
String answerin = request.getParameter("answerin");
String subjectin = request.getParameter("subjectin");%>

Question:
<%=questionin %>

Answer:
<%=answerin %>

Subject:
<%=subjectin %>

<%
Class.forName("com.mysql.jdbc.Driver").newInstance();
connection = DriverManager.getConnection(connectionURL, "", "");
statement = connection.createStatement();

UQ=statement.executeUpdate("INSERT INTO questions" +
"(qid, question, answer, subject)" + "VALUES (" ," + questionin + "," + answerin + "," + subjectin)" );

out.println("Question Added Success");
statement.close();

%>

[cacorat]

this is the error message
: method executeUpdate(java.lang.String, java.lang.String) not found in interface java.sql.Statement

it seems there is a declaration problem. I am using the com.mysql, and the function seems to be present

[cacorat]

Submit Question

<%
String questionin = request.getParameter("questionin");
String answerin = request.getParameter("answerin");
String subjectin = request.getParameter("subjectin");%>

Question:
<%=questionin %>

Answer:
<%=answerin %>

Subject:
<%=subjectin %>

<%
Class.forName("com.mysql.jdbc.Driver").newInstance();
connection = DriverManager.getConnection(connectionURL, "", "");
statement = connection.createStatement();

int UQ=statement.executeUpdate("insert into questions (qid, question, answer, subject) values ('," + questionin + "," + answerin + "," + subjectin + ")");

if (UQ==1)
{
out.println("Question Added Success");
}
else
{
out.println("Addition failed");
}

statement.close();

%>

[cacorat]

the error message:
java.sql.SQLException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '',ooo,ppp,Chemistry)' at line 1

[brambo71c]

the error message: java.sql.SQLException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '',ooo,ppp,Chemistry)' at line 1

The problem is in the query brackets: ('" + blabla + "','" + blabla + "','" + blabla + "')" letting the output like ('xxx','yyy','zzz')

[yup]

Hi,
I think your Html missing some part. Could you please clarify that what is your form doing? Get the question + answer + subject from user... then update to database?

kind regards,
yup

[dnanetwork]

In the following examples, please substitute your information where the following data is referenced:

: enter the MySQL server that you are assigned to, for example, mysql4.safesecureweb.com
: enter the username provided for your database
: enter the password provided for your database
: enter the database name provided for your database
: enter the DSN name (ColdFusion only)
PHP
<?php
$link = mysql_connect('', '', '');
if (!$link) {
die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully';
mysql_select_db();
?>

ColdFusion

Perl
#!/usr/bin/perl

use DBI;

$db = DBI->connect("dbi:mysql:","","")
or die("Couldn't connect");

$db->disconnect;

JSP
<%@ page import="java.sql.*" %>
<%@ page import="com.mysql.jdbc.Driver" %>

<%!
Class.forName("com.mysql.jdbc.Driver").newInstance();
java.sql.Connection conn;
conn = DriverManager.getConnection(
"jdbc:mysql:///?user=&password=");
%>

[jwenting]

Kid, check the dates on threads you're replying to. This one was resolved well over 2 years ago.

But do tell, is it a new sport somewhere to create forum accounts just to post nonsense to age old threads?
I've been seeing it a lot lately.

[weasy]

Javascript is amazing, I didn't think you could touch mysql with it!
Everyone kept telling me to use php with my js to get into sql.
HAHA I feel like a million bucks!

[masijade]

Javascript is amazing, I didn't think you could touch mysql with it! Everyone kept telling me to use php with my js to get into sql. HAHA I feel like a million bucks!

Except that thisisn't JavaScript.

[jwenting]

in fact its only commonality with Javascript is that it's a mess (which it happens to have in common with php as well).

[~s.o.s~]

> Javascript is amazing, I didn't think you could touch mysql with it!

You can't, at least not with browser embedded Javascript. It's a different ball game altogether if you are using Server Side Javascript.

[articles]

The code you have written is correct... but java is a case sensitive language so might be there is some problem with the case..

check it carefully

[masijade]

The code you have written is correct... but java is a case sensitive language so might be there is some problem with the case..

check it carefully

To tell you the truth, the code isnot correct. This line

int UQ=statement.executeUpdate("insert into questions (qid, question, answer, subject) values ('," + questionin + "," + answerin + "," + subjectin + ")");

is definately false (and the cause of the sql error, as noted earlier). Where is the closing quote (') after the variable questionin? And why are there no quotes around any of the others?

All this would not be a problem if the OP would two things that she should always do, and should have done from the beginning (but she probably learned from tutorials on roseindia, they love pushing this dope), which are:

1) Use a PreparedStatement. Donot cobble together a Statement like this. It is error prone in the coding, error prone in the execution (what happens if one of the variables contains a quote (') itself), and wide open to SQL injection attacks.

2) Don't use scriplets. They only still exist for backwards compatability and it is strongly reccommended not to use them anymore.