Reputation: 13
I have written a program which makes a search for the given hindi word in the mysql database and retrieves its corresponding name in english which is stored in the database.It works fine when i give the hindi word directly in the select statement but i would like to give it using a variable so it could be more general but i am not getting the result for the same..Could anyone help me with a solution to it..Thanks in adavance
This is the code which i have written
import java.sql.DriverManager;
import java.sql.Connection;
import java.sql.SQLException;
import com.microsoft.sqlserver.jdbc.*;
import java.sql.*;
public class Example {
public static void main(String[] argv) {
try {
Class.forName("com.mysql.jdbc.Driver");
}
catch (ClassNotFoundException e)
{
System.out.println("Where is your MySQL JDBC Driver?");
e.printStackTrace();
return;
}
Connection connection = null;
SQLServerDataSource dataSource = new SQLServerDataSource();
dataSource.setServerName("COMP-PC");
dataSource.setPortNumber(1433);
dataSource.setDatabaseName("concept");
dataSource.setUser("root");
dataSource.setPassword("abc");
try
{
connection = dataSource.getConnection();
connection.setAutoCommit(false);
System.out.println("Connected to server !!!");
Statement select = connection.createStatement();
String var="N'हल्दी'";
ResultSet result = select.executeQuery
("SELECT Name, Id FROM MConcept where CName=N'हल्दी'");
**// When given like the above statement it works fine
("SELECT Name, Id FROM MConcept where CName='"+var+" ' ");
**//This does not give result
System.out.println("Got results:");
while(result.next()) { // process results one row at a time
String Name = result.getString(1);
int ID = result.getInt(2);
System.out.println("name = " + Name);
System.out.println("id = " + ID);
}
select.close();
connection.close();
}
catch (SQLException e)
{
System.out.println("Connection Failed! Check output console");
e.printStackTrace();
return;
}
if (connection != null)
{
System.out.println("Successfully connected!");
}
else
{
System.out.println("Failed to make connection!");
}
}
}
Upvotes: 1
Views: 1285
Reputation: 89887
You have extra quotes; they're in both var
and in your SQL.
Your working example is:
("SELECT Name, Id FROM MConcept where CName=N'हल्दी'");
While your broken example evaluates to:
("SELECT Name, Id FROM MConcept where CName='N'हल्दी' ' ");
Which presumably not only doesn't give a result, but should result in an error message about your SQL syntax since you have the string literal 'N' followed by unquoted Hindi characters in some encoding and a space in a new string.
It's also a very bad habit to build SQL by concatenating strings; make sure you never do this when the value is coming from user input rather than hardcoded like in your example.
Upvotes: 0
Reputation: 45576
Your second statement is incorrect.
Should be
"SELECT Name, Id FROM MConcept where CName=" + var
But I highly suggest using PreparedStatement and read this cautionary tale of SQL injection -> http://xkcd.com/327/
Upvotes: 2