SQL查询正在拉动一切?

时间:2012-04-14 10:05:23

标签: java mysql sql minecraft

这是一个用于我的世界的插件。它应该使用配置中设置的客户ID拉出玩家并显示它们。无论客户身份是什么,它都会吸引所有人。

if(cmd.getName().equalsIgnoreCase("getaward"))
    {
        Player player = (Player)sender;
        try {
            Class.forName("com.mysql.jdbc.Driver");

        con = DriverManager.getConnection (dbUrl,dbUser,dbPass);

    Statement stmt = con.createStatement();
    ResultSet rs = stmt.executeQuery("SELECT * FROM `votesdb` WHERE `nick` = '"+player.getName().substring(0,player.getName().length()/2)+"' AND `customer_id` LIKE "+config.getString("customer_id")+"");
    //ResultSet rs = stmt.executeQuery("SELECT nick,votes FROM `votesdb` WHERE nick='"+player.getName()+" LIMIT 1");
    if(rs.next())
    {
        if(rs.getInt("votes")!=0)
        {
            player.sendMessage(ChatColor.GREEN+"[VFD]"+ChatColor.AQUA+"Thanks for voting! You will find something special in your inventory. :)");
            bukkit.broadcastMessage(ChatColor.GREEN+"[VFD]"+ChatColor.AQUA+player.getDisplayName()+" has been rewarded for Voting for the Server!");
            stmt.executeUpdate("UPDATE `votesdb` SET flag=0 WHERE `nick` LIKE '"+player.getDisplayName().substring(0,player.getDisplayName().length()/2)+"'");
            player.getInventory().addItem(new ItemStack(this.matID,this.matAmt));


        }
        else
        {
            player.sendMessage(ChatColor.RED+"You have already claimed your reward.");
        }   
    }
    else
    {
        player.sendMessage(ChatColor.RED+"We could not find you in the database! Please make sure you used the correct name when you voted!");
    }

1 个答案:

答案 0 :(得分:1)

  1. 让您尽可能简单地查询,看看它是否有效,然后才能朝着您的目标进行构建。
  2. 除了客户ID之外还有任何其他条件是没有意义的。你说你需要拥有该客户ID的所有玩家。
  3. 如前所述,ID应该被限制为单个值,而不是像某些字符串一样。