HTTP状态500 - ＆＃34;服务器遇到内部错误（），导致无法完成此请求＆＃34;

Question

我正在使用JSP处理Web应用程序。它差不多完成了。但是，在使用update命令时，我遇到了一个奇怪的问题。我试过各方面但没有运气。

以下是错误消息：

**HTTP Status 500 - 
type Exception report

message

The server encountered an internal error () that prevented it from fulfilling this request.

exception 
javax.servlet.ServletException: com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''desc'='<h1 style="text-align: center;">
    cv cfv sdfbgdfbg</h1>', sub_by='SP526' at line 1

root cause 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''desc'='<h1 style="text-align: center;">
    cv cfv sdfbgdfbg</h1>', sub_by='SP526' at line 1

note The full stack traces of the exception and its root causes are available in the GlassFish Server Open Source Edition 3.0.1 logs.
GlassFish Server Open Source Edition 3.0.1**

我的代码如下：

*<%

    String sr=request.getParameter("kt");
    String title=request.getParameter("kt1").trim();
 //  out.println("title"+title);
    String d=request.getParameter("kt2").trim();
   // out.println("description"+d);
    String assignee=request.getParameter("kt3");
   // out.println("Assignee"+assignee);
   java.sql.Timestamp sqlNow=new java.sql.Timestamp(new java.util.Date().getTime());
  //  out.println("date"+sqlNow);

     try{
 Class.forName("com.mysql.jdbc.Driver");
        }

catch (Exception e)
    {
    out.println("<script> alert('Something went wrong')</script>");
    }      
    java.sql.Connection el=DriverManager.getConnection("jdbc:mysql://localhost/kt","root","");

    Statement ed=el.createStatement();
    String aa="update add_kt set title='"+title+"', desc='"+d+"', sub_by='"+assignee+"', Last_mod='"+sqlNow+"' where sr='"+sr+"' ";
     ed.executeUpdate(aa);    

        out.println("<script> alert('Data has been updated')</script>");
   out.println("<a href='admin_page.jsp'>Go to Previous Page</href>");



    %>*

点击提交按钮后，遇到＆＃34;错误HTTP状态500＆＃34;。

Answer 1

使用preparedStatement代替createStatement。因此，您的代码将如下所示。

String query = "update add_kt set title=?, desc=?, sub_by=?, Last_mod=? where sr=?;<br>
PreparedStatement pst = el.prepareStatement(query);<br>
pst.setString(1,title);<br>
pst.setString(2,d);<br>
pst.setString(3,assignee);<br>
pst.setString(4,sql_now);<br>
pst.setString(5,sr);<br>
pst.executeUpdate();

PS：当您有复杂的查询构建器连接时，请始终使用PrepareStatement。