如何使用准备好的语句

Question

有人建议使用准备好的语句，但我不知道如何使用它。我必须在代码中进行哪些更改？

try
{
    Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
    System.out.println("\n Driver loaded");

    Connection con = DriverManager.getConnection("jdbc:odbc:wanisamajDB");

    Statement stmt = con.createStatement();
    System.out.println("statement is created");

    // System.out.println(Integer.parseInt(cbregn.getSelectedItem().toString()));

    String qry = " UPDATE Registration1 SET RegistrationNo = '"+cbregn.getSelectedItem()+"',SeniorPerson = '"+cbnm.getSelectedItem()+"', NativePlace = '"+tfplace.getText()+"',Kul = '"+tfkul.getText()+"', Gotra = '"+tfgotra.getText()+"' ,KulSwami = '"+tfswami.getText()+"', ResidensialAddress = '"+taraddr.getText()+"' , PinCode = '"+tfpcd.getText()+"', STDcode = '"+tfstdcode.getText()+"',TelephoneNo = '"+tftele.getText()+"', MobileNo = '"+tfmno.getText()+"', Email = '"+tfemail.getText()+"',Website ='"+tfweb.getText()+"',Education ='"+tfedu.getText()+"',Branch ='"+tfbrch.getText()+"',BloodGroup ='"+cbbldgrp.getSelectedItem()+"' where SeniorPerson='" +cbnm.getSelectedItem().toString()+"'" ;

          stmt.executeUpdate(qry);

          JOptionPane.showMessageDialog(null,"RECORD IS UPDATED SUCCESSFULLY ");
          System.out.println("QUERY");       

          // cbregn.setEditable(false);
          cbnm.setEditable(false);
          tfplace.setEditable(false);
          tfkul.setEditable(false);
          tfgotra.setEditable(false);
          tfswami.setEditable(false);
          taraddr.setEditable(false);
          tfpcd.setEditable(false);
          tfstdcode.setEditable(false);
          tftele.setEditable(false);
          tfmno.setEditable(false);
          tfemail.setEditable(false);
          tfweb.setEditable(false);
          tfedu.setEditable(false);
          tfbrch.setEditable(false);
          cbbldgrp.setEditable(false);
          con.close();
          stmt.close();
        }
//            catch(SQLException eM)
//            {
//            JOptionPane.showMessageDialog(null,"RECORD IS NOT FOUND ");
//            }
        catch(Exception et)
        {
             et.printStackTrace();
          //  System.out.println("error:"+et.getMessage());
        }  

Answer 1

请参阅示例

准备好的语句可以通过将 SQL 逻辑与数据分离来帮助提高安全性正在供应。这种逻辑和数据的分离有助于防止一种非常常见的漏洞，称为 SQL 注入攻击。通常，当您处理即席查询时，在处理从用户收到的数据时需要非常小心。这需要使用转义所有必要的麻烦字符的函数，例如单引号、双引号和反斜杠字符。在处理准备好的语句时这是不必要的。数据的分离允许 MySQL 自动考虑这些字符，并且不需要使用任何特殊函数对它们进行转义。

Answer 2

在你的代码中而不是这样：

String qry= " UPDATE Registration1 set RegistrationNo = '"+cbregn.getSelectedItem()+"',SeniorPerson = '"+cbnm.getSelectedItem()+"', NativePlace = '"+tfplace.getText()+"',Kul = '"+tfkul.getText()+"', Gotra = '"+tfgotra.getText()+"' ,KulSwami = '"+tfswami.getText()+"', ResidensialAddress = '"+taraddr.getText()+"' , PinCode = '"+tfpcd.getText()+"', STDcode = '"+tfstdcode.getText()+"',TelephoneNo = '"+tftele.getText()+"', MobileNo = '"+tfmno.getText()+"', Email = '"+tfemail.getText()+"',Website ='"+tfweb.getText()+"',Education ='"+tfedu.getText()+"',Branch ='"+tfbrch.getText()+"',BloodGroup ='"+cbbldgrp.getSelectedItem()+"' where SeniorPerson='" +cbnm.getSelectedItem().toString()+"'" ;
stmt.executeUpdate(qry);

试试这个：

String qry= " UPDATE Registration1 set RegistrationNo = ?,SeniorPerson = ?, NativePlace = ?,Kul = ?, Gotra = ?,KulSwami = ?, ResidensialAddress = ?, PinCode = ?, STDcode = ?,TelephoneNo = ?, MobileNo = ?, Email = ?,Website =?,Education =?,Branch =?,BloodGroup =? where SeniorPerson=?" ;

PreparedStatement updateQry = con.prepareStatement(qry);
updateQry.setString(1,cbregn.getSelectedItem());
updateQry.setString(2,cbnm.getSelectedItem());
updateQry.setString(3,tfplace.getText());
updateQry.setString(4,tfkul.getText());
updateQry.setString(5,tfgotra.getText());
updateQry.setString(6,tfswami.getText());
updateQry.setString(7,taraddr.getText());
updateQry.setString(8,tfpcd.getText());
updateQry.setString(9,tfstdcode.getText());
updateQry.setString(10,tftele.getText());
updateQry.setString(11,tfmno.getText());
updateQry.setString(12,tfemail.getText());
updateQry.setString(13,tfweb.getText());
updateQry.setString(14,tfedu.getText());
updateQry.setString(15,tfbrch.getText());
updateQry.setString(16,cbbldgrp.getSelectedItem());
updateQry.setString(17,cbnm.getSelectedItem().toString());
updateQry.executeUpdate():

Answer 3

    public class UpdatesRecords{
     public static void main(String[] args) {
    System.out.println("Updates Records Example through Prepared Statement!");
    Connection con = null;
    try{
      Class.forName("com.mysql.jdbc.Driver");
      con = DriverManager.getConnection(
     "jdbc:mysql://localhost:3306/jdbctutorial","root","root");
      try{
        String sql = "UPDATE movies SET title = ? WHERE year_made = ?";
        PreparedStatement prest = con.prepareStatement(sql);
        prest.setString(1,"Sanam We wafafa");
        prest.setInt(2,2005);
        prest.executeUpdate();
        System.out.println("Updating Successfully!");
        con.close();
      }
      catch (SQLException s){
        System.out.println("SQL statement is not executed!");
      }
    }
     catch (Exception e){
      e.printStackTrace();
    }
   }
}

请使用上面的代码作为参考并更改您的代码