java - 在 Java 语言中错误我的 SQL (Netbeans)

Question

我有代码:

private void btnSaveActionPerformed(java.awt.event.ActionEvent evt) {
    // TODO add your handling code here:

    try {
        con = Connect.ConnectDB();
        if (PatientID.getText().equals("")) {
            JOptionPane.showMessageDialog(this, "Please retrieve Patient ID", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }
        if (txtNoOfDays.getText().equals("")) {
            JOptionPane.showMessageDialog(this, "Please enter no. of days", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }
        if (txtServiceCharges.getText().equals("")) {
            JOptionPane.showMessageDialog(this, "Please retrieve service charges", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }

        if (txtBillingDate.getText().equals("")) {
            JOptionPane.showMessageDialog(this, "Please enter billing date", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }
        if (txtTotalPaid.getText().equals("")) {
            JOptionPane.showMessageDialog(this, "Please enter total paid", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }
        double add1 = Double.parseDouble(txtRoomCharges.getText());
        double add = Double.parseDouble(txtNoOfDays.getText());
        double add2 = add * add1;
        txtTotalRoomCharges.setText(String.valueOf(add2));
        double add3 = Double.parseDouble(txtServiceCharges.getText());
        double add5 = ((add * add1) + add3);
        txtTotalCharges.setText(String.valueOf(add5));
        double paid = Double.parseDouble(txtTotalPaid.getText());
        txtTotalPaid.setText(String.valueOf(paid));
        if (add5 > paid) {
            double datadue = add5 - paid;
            txtDueCharges.setText(String.valueOf(datadue));
        }
        //double add1 = Double.parseDouble(txtTotalCharges.getText());
        //double add2 = Double.parseDouble(txtTotalPaid.getText());

        Statement stmt;
        stmt = con.createStatement();
        String sql1 = "Select DischargeID from bill_room where DischargeID= " + txtDischargeID.getText() + "";
        rs = stmt.executeQuery(sql1);
        if (rs.next()) {
            JOptionPane.showMessageDialog(this, "Record already exists", "Error", JOptionPane.ERROR_MESSAGE);
            return;
        }

        String sql = "insert into bill_room(DischargeID,BillingDate,RoomCharges,ServiceCharges,PaymentMode,PaymentModeDetails,ChargesPaid,DueCharges,TotalCharges,NoOfDays,TotalRoomCharges) values(" + txtDischargeID.getText() + ",'" + txtBillingDate.getText() + "'," + txtRoomCharges.getText() + "," + txtServiceCharges.getText() + ",'" + cmbPaymentMode.getSelectedItem() + "','" + txtPaymentModeDetails.getText() + "'," + txtTotalPaid.getText() + "," + txtDueCharges.getText() + "," + txtTotalCharges.getText() + "," + txtNoOfDays.getText() + "," + txtTotalRoomCharges.getText() + ")";
        pst = con.prepareStatement(sql);
        pst.execute();
        JOptionPane.showMessageDialog(this, "Successfully saved", "Record", JOptionPane.INFORMATION_MESSAGE);
        btnSave.setEnabled(false);

    } catch (HeadlessException | SQLException ex) {
        JOptionPane.showMessageDialog(this, ex);
    }

我有这段代码，当执行运行时(有时顺利，有时出错。) 发生错误时:

com.mysql.jdbc.exceptions.jbdc4.MySQLSyntaxErrorException" You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for right sysntax to use near '110800.0,9,10800.0); at line 1

清楚运行时

这里有什么不对的地方？ 我需要你的帮助或建议

Answer 1

你已经使用了 PreparedStatement 为什么你没有正确使用它，所以为了避免语法错误和 SQL 注入(inject)你可以使用:

String sql = "insert into bill_room(DischargeID, BillingDate, "
        + "RoomCharges, ServiceCharges, PaymentMode, PaymentModeDetails, "
        + "ChargesPaid, DueCharges, TotalCharges, NoOfDays, TotalRoomCharges) "
        + "values(?, ?, ?, ?, ?, ?,  ?, ?, ?, ?, ?)";

try (PreparedStatement insert = connection.prepareStatement(sql)) {

    insert.setInt(1, txtDischargeID.getText());
    insert.setString(2, txtBillingDate.getText());

    //...Set the the right type if int use setInt if string use setString ...

    insert.setDouble(11, Double.parseDouble(txtTotalRoomCharges.getText()));

    insert.executeUpdate();
}

与选择相同。