java.sql.SQLException : Parameter index out of range (1 > number of parameters, 即 0)。我收到这个错误

Question

我尝试从 mysql 数据库搜索数据，但出现此错误:

java.sql.SQLException: Parameter index out of range (1 > number of parameters, which is 0).

main.jsp:

<form action = "SearchCheck" method="post">      
    <input type="text" id="search" class="fadeIn fourth" name="search" placeholder="search">
    <input type="submit" class="fadeIn fourth" value="Search">
</form>

SearchCheck.java:

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // TODO Auto-generated method stub
    response.getWriter().append("Served at: ").append(request.getContextPath());
}

/**
 * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
 */
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {

    request.setCharacterEncoding("EUC-KR");     
    response.setContentType("text/html; charset=euc-kr");
    userSearch=request.getParameter("search");

    if(userSearch == null || userSearch =="" ) {

        PrintWriter out = response.getWriter();
        out.println("<script type=\"text/javascript\">");
        out.println("alert('이름을 채워주십시오');");
        out.println("location='main.jsp';");
        out.println("</script>");

    }


    else {
        try {
            Class.forName("com.mysql.jdbc.Driver");
            conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/member", "root", "Wlsdud1964");                         
            String sql = "SELECT * FROM  user where userName LIKE '%"+userSearch+"%'";              
            System.out.println(sql);        
            ps = conn.prepareStatement(sql);            
            ps.setString(1, userName);
            resultSet = ps.executeQuery();

            //response.sendRedirect("loginCheckResult.jsp");

            while(resultSet.next()) {               
                resultSet.getString(userName);
                resultSet.getString(userGroup);
                PrintWriter out = response.getWriter();
                out.println(resultSet.getString(userName) + resultSet.getString(userGroup));
                out.println("<br /");       
            }           
        } catch(Exception e) {
            e.printStackTrace();
        } finally{
            try {
                if(stmt != null)stmt.close();
                if(conn != null)conn.close();
            }catch(Exception e) {
                e.printStackTrace();
            }
        }   
    }//else     
} //doPost

Answer 1

Tahir 的回答几乎是正确的，正确的 SQL 查询应该是

String sql = "SELECT * FROM  user where userName LIKE ?";

然后你必须“手动”向参数添加 % 通配符，即

String queryString = "%" + userSearch + "%";
ps.setString(1, queryString);