CODEWITHSUNDEEP
javasqloracle-databasejdbcprepared-statement
user3019128
user3019128

Reputation: 1

java.sql.SQLSyntaxErrorException: ORA-00936: missing expression

I wrote a simple SQL query in Oracle which inserts some values.

But I got SQLSyntaxErrorException stating a "missing expression" error.

This my query:

String addManager = "INSERT INTO property_manager(EIN,NAME,HOME_PHONENUMBER,MOBILE_PHONENUMBER,EMAIL,PROPERTY_CIN)" +
       "VALUES (" + mein.getText() + ","  + mname.getText() +","+    mHome_phonenumber.getText() +","+ MMobile_phonenumber.getText()+"," + memail.getText() + ","+mproperty_cin.getText()+")";

Upvotes: 0

Views: 6879

Answers (2)

Amir Pashazadeh
Amir Pashazadeh

Reputation: 7322

The best solution is using a java.sql.PreparedStatement.

  • It prevents SQL injection
  • Escapes invalid characters in your Strings (such as ') and the characters which will break your query
  • handles null and empty Strings
  • Uses Oracle's query parsing cache (for better performance)
  • Handles types such as Date and Blob much easier

Just google for java PreparedStatemnt and you see lots of samples.

Upvotes: 2

Alen Oblak
Alen Oblak

Reputation: 3325

You should put your values inside quotes.

String addManager = "INSERT INTO property_manager(EIN,NAME,HOME_PHONENUMBER,MOBILE_PHONENUMBER,EMAIL,PROPERTY_CIN)" +
   "VALUES ('" + mein.getText() + "','"  + mname.getText() +"','"+    mHome_phonenumber.getText() +"','"+ MMobile_phonenumber.getText()+"','" + memail.getText() + "','"+mproperty_cin.getText()+"')";

Or better yet, use parameters. Otherwise you risk sql injection attack.

Upvotes: 0

Related Questions