-1

大家好,我正在尝试为我的 java 网站创建一个注册 servlet,但我收到了这个错误,我不明白,因为第 1 行没有任何内容。

Error.com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '',)' at line 1

这是我的 servlet 代码

import java.io.IOException;


import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;




/**
 * Servlet implementation class CreateTutor
 */
@WebServlet("/CreateTutor")
public class CreateTutor extends HttpServlet {
    private static final long serialVersionUID = 1L;

    /**
     * @see HttpServlet#HttpServlet()
     */
    public CreateTutor() {
        super();
        // TODO Auto-generated constructor stub
    }

    private String uniid = ""; 
    private String name = ""; 
    private String password = ""; 
    private String email = ""; 
    private int access_level = 3;

    public void init() {
      try {
          Class.forName("com.mysql.jdbc.Driver");
          Connection con =
            DriverManager.getConnection("jdbc:mysql://localhost:3306/wae","root","");
        System.out.println("JDBC driver loaded"); 
      } 
      catch (ClassNotFoundException e) {
        System.out.println(e.toString()); 
      } catch (SQLException e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    } 
    } 

    /**Process the HTTP Get request*/ 
    public void doGet(HttpServletRequest request, HttpServletResponse response) throws 
  ServletException,IOException {  
      sendPageHeader(response); 
      sendRegistrationForm(request, response, false); 
      sendPageFooter(response); 
    } 

    /**Process the HTTP Post request*/ 
    public void doPost(HttpServletRequest request, 
      HttpServletResponse response) 
      throws ServletException, IOException {
      sendPageHeader(response); 

      uniid = request.getParameter("uniid"); 
      name = request.getParameter("name"); 
      password = request.getParameter("password"); 
      email = request.getParameter("email");


      boolean error = false; 
      String message = null; 
      try {
          Class.forName("com.mysql.jdbc.Driver");
          Connection con = 
            DriverManager.getConnection("jdbc:mysql://localhost:3306/wae","root","");
        System.out.println("got connection"); 

        Statement s = con.createStatement(); 

        String sql = "SELECT name FROM user" + 
          " WHERE name='" + name + "'"; 
        ResultSet rs = s.executeQuery(sql); 
        if (rs.next()) {
          rs.close(); 
          message = "The user name <B>" + name + 
            "</B> has been taken. Please select another name."; 
          error = true; 
        } 
        else {
          rs.close(); 
          sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
            " '" +  name + "'," + 
            " '" +  password + "'," + 
            " '" + email + "'," + access_level + "',)"; 
          int i = s.executeUpdate(sql); 
          if (i==1) {
            message = "Successfully added one user."; 
          } 
        } 
          s.close(); 
          con.close(); 
        } 
        catch (SQLException e) {
          message = "Error." + e.toString(); 
          error = true; 
        } 
        catch (Exception e) {
          message = "Error." + e.toString(); 
          error = true; 
        } 
        if (message!=null) {
          PrintWriter out = response.getWriter(); 
          out.println("<B>" + message + "</B><BR>"); 
          out.println("<HR><BR>"); 
        } 
        if (error==true) 
          sendRegistrationForm(request, response, true); 
        else 
          sendRegistrationForm(request, response, false); 
        sendPageFooter(response); 
      } 

      /** 
       * Send the HTML page header, including the title 
       * and the <BODY> tag 
       */ 
      private void sendPageHeader(HttpServletResponse response) 
        throws ServletException, IOException {
        response.setContentType("text/html"); 
        PrintWriter out = response.getWriter(); 
        out.println("<HTML>"); 
        out.println("<HEAD>"); 
        out.println("<TITLE>Registration Page</TITLE>"); 
        out.println("</HEAD>"); 
        out.println("<BODY>"); 
        out.println("<CENTER>"); 
      } 

      /** 
       * Send the HTML page footer, i.e. the </BODY> 
       * and the </HTML> 
       */ 
      private void sendPageFooter(HttpServletResponse response) 
        throws ServletException, IOException {
        PrintWriter out = response.getWriter(); 
        out.println("</CENTER>"); 
        out.println("</BODY>"); 
        out.println("</HTML>"); 
      }   
      /**Send the form where the user can type in 
       * the details for a new user 
       */ 
      private void sendRegistrationForm(HttpServletRequest request, 
        HttpServletResponse response, boolean displayPreviousValues) 
        throws ServletException, IOException {

        PrintWriter out = response.getWriter(); 
        out.println("<BR><H2>Registration Page</H2>"); 
        out.println("<BR>Please enter the user details."); 
        out.println("<BR>"); 
        out.println("<BR><FORM METHOD=POST>"); 
        out.println("<TABLE>"); 
        out.println("<TR>"); 
        out.println("<TD>Uni Id</TD>"); 
        out.print("<TD><INPUT TYPE=TEXT Name=uniid"); 

        if (displayPreviousValues) 
          out.print(" VALUE=\"" + uniid + "\""); 

        out.println("></TD>"); 
        out.println("</TR>"); 
        out.println("<TR>"); 
        out.println("<TD>Name</TD>"); 
        out.print("<TD><INPUT TYPE=TEXT Name=name"); 

        if (displayPreviousValues) 
          out.print(" VALUE=\"" + name + "\""); 

        out.println("></TD>"); 
        out.println("</TR>"); 
        out.println("<TR>"); 
        out.println("<TD>Password</TD>"); 
        out.print("<TD><INPUT TYPE=PASSWORD Name=password"); 

        if (displayPreviousValues) 
          out.print(" VALUE=\"" + password + "\""); 

        out.println("></TD>"); 
        out.println("</TR>"); 
        out.println("<TR>"); 
        out.println("<TD>Email</TD>"); 
        out.print("<TD><INPUT TYPE=TEXT Name=email");
        out.println("></TD>");
        out.println("</TR>");
        out.println("<TR>");
        out.println("<TD>Access Level</TD>");
        out.print("<TD><INPUT TYPE=int Name=access_level");
        out.println("></TD>");
        out.println("</TR>");
        if (displayPreviousValues) 
        out.print(" VALUE=\"" + password + "\""); 
        out.println("></TD>"); 
        out.println("</TR>");

        out.println("<TR>"); 
        out.println("<TD><INPUT TYPE=RESET></TD>"); 
        out.println("<TD><INPUT TYPE=SUBMIT></TD>"); 
        out.println("</TR>"); 
        out.println("</TABLE>"); 
        out.println("</FORM>"); 
        out.println("<BR>"); 
        out.println("<BR>"); 
      } 
}
4

7 回答 7

3

错误很明显:发送到 MySQL 的 SQL 中有语法错误。尝试打印出你发送的内容,它会比在代码中阅读更容易看到。

但更重要的是 - 不要这样做。

  1. 您应该使用 PreparedStatement 并绑定您的输入变量。
  2. 您应该使用 JNDI 连接池。
  3. 你不应该硬连线你的连接细节——不是一次,而是两次!
  4. 您将 HTML 编码到一个 servlet 中。最好将 JSP 与 JSTL 一起使用。
  5. 您不验证您的输入。这是等待发生的 SQL 注入攻击。

现在就足够了。

于 2012-10-01T11:35:46.147 回答
1
sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
            " '" +  name + "'," + 
            " '" +  password + "'," + 
            " '" + email + "'," + access_level + "',)"; 

改成: -

sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
               " '"  +  name + "'," + 
               " '"  +  password + "'," + 
               " '"  + email + "','" + access_level + "')";

您在查询后错过了尾随逗号..

于 2012-10-01T11:35:31.357 回答
0

,您的 select 语句中有一个额外的逗号,而不是:

sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
            " '" +  name + "'," + 
            " '" +  password + "'," + 
            " '" + email + "'," + access_level + "',)"; 

                                                  /|\
                         this ----------------------

它应该是

sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
            " '" +  name + "'," + 
            " '" +  password + "'," + 
            " '" + email + "'," + access_level + "')"; 

我不了解 Java,但您应该使用准备好的语句或 Java 中的任何其他方式来清理您的数据,让您指定参数,而不是直接在 sql 语句中写入输入的值。

于 2012-10-01T11:35:11.957 回答
0

我认为有问题的行是:

"INSERT INTO user" + 
        " (uniid, name, password, email, access_level)" + 
        " VALUES" + 
        " ('" +  uniid + "'," + 
        " '" +  name + "'," + 
        " '" +  password + "'," + 
        " '" + email + "'," + access_level + "',)

请注意查询末尾的逗号

于 2012-10-01T11:35:22.413 回答
0

你错过了单引号 & 并且有额外的逗号

" '" + email + "'," + access_level + "',)"; 在你的代码中。

它应该是 " '" + email + "','" + access_level + "')";

于 2012-10-01T11:35:24.447 回答
0

您的查询末尾有一个额外的逗号:更改以下内容

 sql = "INSERT INTO user" + 
                " (uniid, name, password, email, access_level)" + 
                " VALUES" + 
                " ('" +  uniid + "'," + 
                " '" +  name + "'," + 
                " '" +  password + "'," + 
                " '" + email + "'," + access_level + "',)"; 

到:

sql = "INSERT INTO user" + 
            " (uniid, name, password, email, access_level)" + 
            " VALUES" + 
            " ('" +  uniid + "'," + 
            " '" +  name + "'," + 
            " '" +  password + "'," + 
            " '" + email + "'," + access_level + "')"; 

我强烈建议您使用Prepared statement API

于 2012-10-01T11:35:50.990 回答
0

这是 SQL 请求的第 1 行,而不是 java 程序的第 1 行。让您的程序将请求打印到控制台,然后从那里进行调试。

于 2012-10-01T11:35:57.323 回答