2

大师们，我是 Java SQL 的新手，需要一些帮助。我正在尝试从 MS SQL Server 2008 获取参数。数据肯定存在 - 它是当前有效的数据库，我正在尝试使用用户记录来获取另一个应用程序的凭据。

我断言了以下查询：

 String query = "SELECT [USER].qc_number FROM [USER] WHERE "[USER].login_name = '"
 + userNameInput + "' AND [USER].password = '" + passWordInput + "';";

从用户那里收到的信息userNameInput。passWordInputURL、查询和驱动程序类绝对正确：我从应用程序和服务器视图检查了 DB 模式。此外，我通过一一更改参数来验证所有异常系统，从而生成正确的异常消息。但是，我得到一个包含 1 列和 0 行的结果集。

代码如下：

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class trOdbc 
{// database URL                              
    final String DB_URL = "***";
    final String Class_URL = "com.microsoft.sqlserver.jdbc.SQLServerDriver";

    private Connection connection = null; // manages connection
    private Statement statement = null; // query statement
    private ResultSet resultSet = null; // manages results
    private Boolean connectedToDatabase = false;

// ----------------------------------------------------------

        public void createJdbcConnection() 
    { // connect to database books and query database
        if (connectedToDatabase)
        {   return; }
        try 
                { // connectedToDatabase is false - establish the connection
            Class.forName(Class_URL); 
            connection = DriverManager.getConnection
                (DB_URL, "***", "***" );
            statement = connection.createStatement
                (ResultSet.TYPE_SCROLL_INSENSITIVE, 
                 ResultSet.CONCUR_READ_ONLY); 
            connectedToDatabase = true;
        } 
        catch (SQLException ex) 
            { System.out.println ("SQL Exception in connection establishment: " + ex); }
        catch (ClassNotFoundException ex) 
            { System.out.println ("Class not found exception in query process: " + ex); }
    }

// ----------------------------------------------------------

    public String [][] processJdbcQuery (String query)
    {                
        createJdbcConnection ();
        if (!connectedToDatabase)
                {   return null; }// the connection wasn't established 

        try 
        {// query database
            resultSet = statement.executeQuery(query);
            int columns = resultSet.getMetaData().getColumnCount();
                        int rows = 0;
            if (resultSet != null)
            {
                resultSet.beforeFirst();
                resultSet.last();
                rows = resultSet.getRow();
            }
            String [][] tempData = new String[rows][columns];
            resultSet.beforeFirst();
                        rows = 0;
                        while (resultSet.next())
            {
                for (int x = 1; x <= columns; x++) 
                {
                    tempData [rows][x - 1] = resultSet.getString (x);
                }
                                rows++;
            } 
            CloseJdbcConnection ();
            return tempData;
        }
        catch (SQLException ex) 
                {   
            System.out.println ("SQL Exception in query process: " + ex);
            CloseJdbcConnection ();
            return null; 
                }
    } // end processJdbcQuery

// ----------------------------------------------------------

        public void CloseJdbcConnection()
    {              
        if ( connectedToDatabase )                  
        {// close Statement and Connection. resultSet is closed automatically.
            try 
            {
                statement.close();                        
                connection.close();                            
                connectedToDatabase = false;
            } 
            catch (SQLException ex) 
                { System.out.println ("SQL Exception in connection closure: " + ex); }
        } // end if
    } // end method CloseJdbcConnection          
} // end class trOdbc
4

1 回答 1

2

你为什么不使用准备好的语句呢？

这是在java中使用准备好的语句的一个很好的教程

在您的情况下，它将是：

String query = "SELECT [USER].qc_number FROM [USER] " +
        "WHERE [USER].login_name = ? AND [USER].password = ?;";

然后在每次执行时将其设置为不同的值：

PreparedStatement ps = connection.prepareStatement(query);

ps.setString(1, userNameInput);
ps.setString(2, passWordInput);

resultSet = ps.executeQuery();
于 2012-12-31T13:12:06.760 回答