+++++++++++++++++++++++一个字闷!!!!++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[99percent]

String input2=new String (input.getBytes("ISO-8859-1"));
String subcategory_id=request.getParameter("subcategory_id");

if(input!=null)
{
String sql="select * from news where subcategory_id=? and title like ? ";
PreparedStatement stmt=conn.preparetatement(sql);
stmt.setString(1,subcategory_id);
stmt.setString(2,inupt2);
}
else
{
String sql="select * from news where subcategory_id=?";
PreparedStatement stmt=conn.preparetatement(sql);
stmt.setString(1,subcategory_id);
}
rs=stmt.executeQuery();

========================================================================================
防SQL注入是不是这样写啊???????????????(没有这样改的时候可以链接到数据库读到数据.)

错误:
Generated servlet error:
[javac] Compiling 1 source file

E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:253: sql is already defined in _jspService(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)
String sql="select * from news where subcategory_id=? and title like ? ";
^



An error occurred at line: 30 in the jsp file: /other/operation.jsp

Generated servlet error:
E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:254: cannot resolve symbol
symbol : method preparetatement (java.lang.String)
location: class jmeport.conn
PreparedStatement stmt=conn.preparetatement(sql);
^



An error occurred at line: 30 in the jsp file: /other/operation.jsp

Generated servlet error:
E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:256: cannot resolve symbol
symbol : variable inupt2
location: class org.apache.jsp.other.operation_jsp
stmt.setString(2,inupt2);
^



An error occurred at line: 30 in the jsp file: /other/operation.jsp

Generated servlet error:
E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:261: sql is already defined in _jspService(javax.servlet.http.HttpServletRequest,javax.servlet.http.HttpServletResponse)
String sql="select * from news where subcategory_id=?";
^



An error occurred at line: 30 in the jsp file: /other/operation.jsp

Generated servlet error:
E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:262: cannot resolve symbol
symbol : method preparetatement (java.lang.String)
location: class jmeport.conn
PreparedStatement stmt=conn.preparetatement(sql);
^



An error occurred at line: 30 in the jsp file: /other/operation.jsp

Generated servlet error:
E:\Tomcat 5.0\work\Catalina\localhost\_\org\apache\jsp\other\operation_jsp.java:267: cannot resolve symbol
symbol : variable stmt
location: class org.apache.jsp.other.operation_jsp
rs=stmt.executeQuery();
^

[MARS.nEIL]

如上..

[yinleiyoung]

楼主，其中又很多只语法错误
而且：
String sql="select * from news where subcategory_id=? and title like ? ";
PreparedStatement stmt=conn.preparetatement(sql);
stmt.setString(1,subcategory_id);
stmt.setString(2,inupt2);

必须先 inupt2="%"+inupt2+"%"; 才行啊

[99percent]

谁能用Q来远程控制我的电脑帮下我调试一下啊?????????????
Q:32441323

[pigrain]

咳....先喝杯什么东西..再坐下慢慢看...这样效率很高.....你现在急成这样了

[99percent]

谁能用Q来远程控制我的电脑帮下我调试一下啊?????????????
Q:32441323

[99percent]

up

[99percent]

UP

[qiuzhong1983]

挖赛

[DanielYWoo]

你用的什么IDE啊，这么多错误应该IDE有提示阿

[joyaga]

拼写错误这么多 要注意了看看jdkapi

[dakuntk]

接分,郁闷,人生难免~~
好多语法错误啊...

[99percent]

现在仅求解决方法.不论什么方法.(防SQL注入式漏洞)

[99percent]

现在仅求解决方法.不论什么方法.(防SQL注入式漏洞)

[xiaohuozhi]

up up up

[jianan]

防SQL注入式漏洞,就用 preparetatement就可以

[yinleiyoung]

楼主的精神真是值得学习啊，应该发了至少有四个类似的帖子了吧？
我在楼主的“……逼上梁山……”的帖子中做了回答了，不知结果如何
崇拜！
顶一下！！

[99percent]

有没有能帮下忙写一下啊?


回复人： hesi726(hesi) ( ) 信誉：98 2005-04-19 11:36:00 得分: 0


很明显，你的 conn me 没有 prepareStatement 方法。
那么，另外一个方法就是对传入的参数进行替换
把 ' 替换成 '' 即可以解决你的问题..


那么我没有preparestatement怎么加上去啊/

[cqpower]

呵呵，，同情楼主
你应该静下心来，很快就解决了的。越慌越错。

[不徻写代码]

嘿嘿

[jin2005]

介意一下，下次不要发名字这个长的贴名，占空间。这个问题有很多是你的语法问题先看看书，再来发贴。