CODEWITHSUNDEEP
javamysqljdbc
romofan23
romofan23

Reputation: 69

How do I insert Java variables into a MySQL query?

I am trying to create a register system for my MySQL database. I have a Java form that I created, in which the user inserts a username, password, and their email. I take that infromation and store it in a variable accordingly. The MySQL connection code works, and it does insert a new row, but the information is blank on the MySQL page. Am I doing someting wrong?

public class Main extends JFrame {

private static final long serialVersionUID = 1L;

private JPanel contentPane;
private JTextField textField;
private JPasswordField passwordField;

private static Connection con;
private static PreparedStatement st;
private static int rs;

String username;
String password;
String email;
private JTextField textField_1;

String insertTableSQL = "INSERT INTO `users`" + "(username, password, email) VALUES" + "(?,?,?)";

public static void main(String[] args) {
    EventQueue.invokeLater(new Runnable() {
        public void run() {
            try {
                Main frame = new Main();
                frame.setVisible(true);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    });
}

public Main() {
    setResizable(false);
    setTitle("Barrage : Login / Register");
    setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
    setBounds(100, 100, 350, 200);
    contentPane = new JPanel();
    contentPane.setBorder(new EmptyBorder(5, 5, 5, 5));
    setContentPane(contentPane);
    contentPane.setLayout(null);

    JLabel lblNewLabel = new JLabel("Username: ");
    lblNewLabel.setBounds(60, 25, 68, 20);
    contentPane.add(lblNewLabel);

    JLabel lblPassword = new JLabel("Password: ");
    lblPassword.setBounds(60, 59, 68, 20);
    contentPane.add(lblPassword);

    textField = new JTextField();
    username = textField.getText();
    textField.setBounds(138, 22, 120, 26);
    contentPane.add(textField);
    textField.setColumns(10);

    passwordField = new JPasswordField();
    password = passwordField.getText();
    passwordField.setBounds(138, 56, 120, 26);
    contentPane.add(passwordField);

    JButton btnRegister = new JButton("Register");
    btnRegister.addActionListener(new ActionListener() {

        public void actionPerformed(ActionEvent arg0) {
            try{
                Class.forName("com.mysql.jdbc.Driver");
                con = DriverManager.getConnection("jdbc:mysql://localhost:3306/barrage", "root", "");
                st = con.prepareStatement(insertTableSQL);
                st.setString(1, username);
                st.setString(2, password);
                st.setString(3, email);
                st.executeUpdate();
            } catch(Exception e) {
                e.printStackTrace();
            }
        }

    });
    btnRegister.setBounds(119, 138, 89, 23);
    contentPane.add(btnRegister);

    JLabel lblEmail = new JLabel("E-mail: ");
    lblEmail.setBounds(60, 96, 68, 20);
    contentPane.add(lblEmail);

    textField_1 = new JTextField();
    email = textField_1.getText();
    textField_1.setBounds(138, 93, 120, 26);
    contentPane.add(textField_1);
    textField_1.setColumns(10);
}

}

Upvotes: 1

Views: 2062

Answers (1)

Daniel Kaplan
Daniel Kaplan

Reputation: 67310

Don't do it this way. This is a security vulnerability called a SQL Injection. Instead use a PreparedStatement with variable binding (eg: ?). Here is a tutorial.

As for why it's blank in the database (which is what I think you're saying), you're going to have to prove that the value of those variables are not blank with traditional debugging. IMO, if your tables were set up with the correct constraints (eg: not null) it wouldn't even let you insert in that invalid state in the first place.

Upvotes: 7

Related Questions