import java.awt.*;
import javax.swing.*;
import java.awt.event.*;
import java.sql.*;
public class Bookmenow implements ActionListener
{
JButton btn;
private Connection conn = null;
JTextField txtname;
List l = new List (20, false);
Bookmenow ()
{
JFrame jf = new JFrame ();
//jf.setSize (250, 250);
// jf.setLocation (350, 200);
jf.setBounds (400, 100, 350, 200); jf.setTitle ("Bookin Process...");
jf.setResizable (false);
jf.setDefaultCloseOperation (JFrame.EXIT_ON_CLOSE);
Font f = new Font ("Comic Sans MS", Font.ITALIC + Font.BOLD, 12);
JLabel lbl1 = new JLabel ("Name and Surname");
lbl1.setBounds (30, 80, 50, 20);
lbl1.setFont (f);
txtname = new JTextField ();
txtname.setBounds (100, 80, 120, 20);
txtname.setFont (f);
btn = new JButton ("Submit");
btn.setBounds (100, 120, 120, 20);
btn.addActionListener (this);
connect();
Container c = jf.getContentPane ();
c.setLayout (null);
c.setBackground (Color.yellow);
c.add (lbl1);
c.add (txtname);
c.add (btn);
jf.setVisible (true);
}
public void connect ()
{
try
{
Class.forName ("sun.jdbc.odbc.JdbcOdbcDriver");
JOptionPane.showMessageDialog (null, "Successfully Loaded Database Driver", "Success", JOptionPane.PLAIN_MESSAGE);
}
catch (ClassNotFoundException c)
{
JOptionPane.showMessageDialog (null, "Cannot Load Database Driver", "Error", JOptionPane.ERROR_MESSAGE);
}
try
{
conn = DriverManager.getConnection ("jdbc:odbc:Driver={Microsoft Access Driver (*.mdb)}; DBQ=Book-data");
JOptionPane.showMessageDialog (null, "Successfully Loaded The Database ", "Success", JOptionPane.PLAIN_MESSAGE);
}
catch (Exception e)
{
JOptionPane.showMessageDialog (null, "Cannot Load The Database", "Error", JOptionPane.ERROR_MESSAGE);
}
}
public void Bok(String txtname)
{
try
{
Statement stmt = conn.createStatement();
String query = "INSERT INTO Booked VALUES '" +txtname + "'";
stmt.executeUpdate (query);
}
catch (Exception e)
{
System.out.println(e);
}
}
public void actionPerformed (ActionEvent event)
{
if (event.getSource () == btn)
{
Bok(txtname.getText());
}
}
public static void main (String[] args)
{
Bookmenow s = new Bookmenow ();
}
}
Cant find the errorIt gives me a Insert into statement error
Page 1 of 1
4 Replies - 609 Views - Last Post: 30 August 2008 - 10:23 PM
#1
Cant find the error
Posted 28 August 2008 - 09:57 AM
Replies To: Cant find the error
#2
Re: Cant find the error
Posted 28 August 2008 - 11:58 AM
Havnt compiled your code or anything but it looks like your query is wrong in regards to your use of ' and ". I can see 3 " which i presume 1 of them isnt closing anything off.
#3
Re: Cant find the error
Posted 28 August 2008 - 03:29 PM
SQL statements should terminates by a ;
String query = "INSERT INTO Booked VALUES '" +txtname + "';";
String query = "INSERT INTO Booked VALUES '" +txtname + "';";
#4
Re: Cant find the error
Posted 29 August 2008 - 01:47 AM
PLEEEEEEEEEAAASE!
I know it is for correcting the user's error, but please, please, please have some bad feeling to post anything like String query = "INSERT INTO Booked VALUES '" +txtname + "';";
It is really bad practice to insert any parameter into an SQL statement like this (see SQL injection).
Use a PreparedStatement that will escape your parameters - and it will also save you the headache with the quotes.
Concatenating parameters as Strings into SQL statements is like standing on top of a hill in a lightning storm in an armor shouting all gods can kiss your *ss.
I know it is for correcting the user's error, but please, please, please have some bad feeling to post anything like String query = "INSERT INTO Booked VALUES '" +txtname + "';";
It is really bad practice to insert any parameter into an SQL statement like this (see SQL injection).
Use a PreparedStatement that will escape your parameters - and it will also save you the headache with the quotes.
Concatenating parameters as Strings into SQL statements is like standing on top of a hill in a lightning storm in an armor shouting all gods can kiss your *ss.
#5
Re: Cant find the error
Posted 30 August 2008 - 10:23 PM
1lacca, on 29 Aug, 2008 - 01:47 AM, said:
PLEEEEEEEEEAAASE!
I know it is for correcting the user's error, but please, please, please have some bad feeling to post anything like String query = "INSERT INTO Booked VALUES '" +txtname + "';";
It is really bad practice to insert any parameter into an SQL statement like this (see SQL injection).
Use a PreparedStatement that will escape your parameters - and it will also save you the headache with the quotes.
Concatenating parameters as Strings into SQL statements is like standing on top of a hill in a lightning storm in an armor shouting all gods can kiss your *ss.
I know it is for correcting the user's error, but please, please, please have some bad feeling to post anything like String query = "INSERT INTO Booked VALUES '" +txtname + "';";
It is really bad practice to insert any parameter into an SQL statement like this (see SQL injection).
Use a PreparedStatement that will escape your parameters - and it will also save you the headache with the quotes.
Concatenating parameters as Strings into SQL statements is like standing on top of a hill in a lightning storm in an armor shouting all gods can kiss your *ss.
1Licca is right, not going to the point of the lighning storm may be, but PreparedStatement add the last ";" if you gorgot to put in on.
Page 1 of 1
|
|

New Topic/Question
Reply




MultiQuote





|