JDBC（Derby）INSERT查询因SQLSyntaxErrorException而失败

Question

我的INSERT查询因SQLSyntaxErrorException而失败。我试图检查我的表的结构，看看是否有错误的数据类型，但我一直收到这条消息。 请帮我确定导致此错误的原因。我被卡住了。我不确定我的组件引用是否正确。

我的.grab文件详细信息如下

        String completeBirthday = getCompleteBirthdayFromComboBoxes(); 
        String employmentStatus = getStringValue_Of_EmploymentStatus_Selected();

        Connection con = DriverManager.getConnection(url, username, password);
        Statement stat = con.createStatement();

        String InsertQuery = "INSERT INTO EMPLOYEE(EMPLOYEE_ID,EMP_LASTNAME,EMP_FIRSTNAME,EMP_MIDDLENAME,ADDRESS,POSITION,GENDER,BIRTHMONTH,BIRTHDAY,BIRTHYEAR,EMAIL,YEARSOFEXPERIENCE,BASICSALARY,EMPLOYMENTSTATUS)"
                + "VALUES "
                + "(' "+AddEmployee_EmployeeID_TxtField.getText()+" ',' "
                + " "+AddEmployee_LastName_TxtField.getText()+" ',' "
                + " "+AddEmployee_FirstName_TxtField.getText()+" ',' "
                + " "+AddEmployee_MiddleName_TxtField.getText()+" ',' "
                + " "+AddEmployee_Address_TxtField.getText()+" ',' "
                + " "+AddEmployee_Position_TxtField.getText()+" ',' "
                + " "+AddEmployee_Gender_ComboBox.getSelectedItem()+" ',' "
                + " "+AddEmployee_BirthdayMonth_ComboBox.getSelectedItem()+" ',' "
                + " "+AddEmployee_BirthdayDay_ComboBox.getSelectedItem()+" ',' "
                + " "+AddEmployee_BirthdayYear_ComboBox.getSelectedItem()+" ',' "
                + " "+AddEmployee_Email_TxtField.getText()+" ',' "
                + " "+AddEmployee_YearsOfExperience_TxtField.getText()+" ',' "
                + " "+AddEmployee_BasicSalary_TxtField.getText()+" ',' "
                + " "+employmentStatus+" "
                + " ')"
                ;


        stat.execute(InsertQuery); //execute() will run the insert query above.
        JOptionPane.showMessageDialog(null,"Insert Success!"); 

我很感激任何帮助。提前谢谢。

Answer 1

正如问题评论中所述，您确实应该使用PreparedStatement来执行参数化查询，其中包括：

String insertQuery = "INSERT INTO EMPLOYEE(EMPLOYEE_ID,EMP_LASTNAME,EMP_FIRSTNAME,EMP_MIDDLENAME,ADDRESS,POSITION,GENDER,BIRTHMONTH,BIRTHDAY,BIRTHYEAR,EMAIL,YEARSOFEXPERIENCE,BASICSALARY,EMPLOYMENTSTATUS)"
        + "VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
PreparedStatement stat = con.prepareStatement(insertQuery);
stat.setString(1, AddEmployee_EmployeeID_TxtField.getText());
stat.setString(2, AddEmployee_LastName_TxtField.getText());
stat.setString(3, AddEmployee_FirstName_TxtField.getText());
stat.setString(4, AddEmployee_MiddleName_TxtField.getText());
stat.setString(5, AddEmployee_Address_TxtField.getText());
stat.setString(6, AddEmployee_Position_TxtField.getText());
stat.setString(7, AddEmployee_Gender_ComboBox.getSelectedItem());
stat.setString(8, AddEmployee_BirthdayMonth_ComboBox.getSelectedItem());
stat.setString(9, AddEmployee_BirthdayDay_ComboBox.getSelectedItem());
stat.setString(10, AddEmployee_BirthdayYear_ComboBox.getSelectedItem());
stat.setString(11, AddEmployee_Email_TxtField.getText());
stat.setInt(12, Integer.valueOf(AddEmployee_YearsOfExperience_TxtField.getText()));
stat.setInt(13, Integer.valueOf(AddEmployee_BasicSalary_TxtField.getText()));
stat.setString(14, employmentStatus);
stat.executeUpdate();

这种方法避免了不必担心引用字符串值的麻烦，并且可以防止SQL注入问题（例如，当LastName为“O'Brian”时，代码不会爆炸）

Answer 2

尝试插入数字字段而不用'character

包围它

像这样：

AddEmployee_BirthdayYear_ComboBox.getSelectedItem()+" ',' " + " 
"+AddEmployee_Email_TxtField.getText()+" '," + "
"+AddEmployee_YearsOfExperience_TxtField.getText()+" , " + " 
"+AddEmployee_BasicSalary_TxtField.getText()+" ,'