关于Java与SQL的问题

[wangju19870301]

String s1=tf1.getText();
String s2=tf2.getText();
String s3=tf3.getText();
String s4=tf4.getText();
String s5=tf5.getText();
String s6=tf6.getText();
String s7=tf7.getText();
String s8=tf8.getText();
String JDriver="sun.jdbc.odbc.JdbcOdbcDriver";
String conURL="jdbc:odbc:TestDB";
try
{
Class.forName(JDriver);
}
catch(java.lang.ClassNotFoundException e)
{
System.out.println("ForName:"+e.getMessage());
}
try
{
Connection con=DriverManager.getConnection(conURL);
Statement s=con.createStatement();
String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";
s.executeUpdate(r1);
s.close();
con.close();
}
catch(SQLException e)
{
System.out.println("SQLException:"+e.getMessage());
}

请问String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";这一 有 有问题啊?
其中tf1～tf8为JTextField

[joejoe1991]

String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";

因为你的String 写到引号里了。所以不对

[wangju19870301]

请问应如何改正才能正确?

[zhoutaomtv]

String r1="insert into person values("+"'s1','s2','s3','s4','s5','s6','s7','s8')";
应改为
String r1="insert into person values('"+s1+"','"+s2+"','"+s3+"','"+s4+"','"+s5+"','+s6+"','"+s7+"','+s8+"')";

[tdy1234]

楼上正解

[orangemike]

所以我们要尽量用PreparedStatement 而不是Statement