java - 带 HashMap 的准备语句，异常

Question

需要一点帮助。遇到一些异常问题，我对使用这个库非常陌生。预先感谢:)

错误:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''common_translations.name' as nm JOIN ('common_translations.name_id' as nid)

我的代码:

private DatabaseConnection db;
private final HashMap <String, String> statements;

public DatabaseReader(DatabaseConnection db) {
    statements = new HashMap<String, String>() {
        private static final long serialVersionUID = -1827340576955092045L;
    {
        put("odds","vfl::%");
        put("common_translations", "vhc::%");
        put("common_translations","vdr::%");
        put("common_translations", "vto::%");
        put("common_translations","vbl::%");
        put("common_translations", "vf::%");
        put("odds","vsm::%");
        put("odds", "rgs::%");
        put("odds", "srrgs::%");
    }};

    this.db = db;
}

public void read() {
    try {
        Connection connection = db.connect(db.getUrl_common_translation());
        PreparedStatement ps = (PreparedStatement) connection.prepareStatement("SELECT nm.id, nid.key, nm.name FROM ? as nm JOIN (? as nid)\r\n" + 
                "                 ON (nm.id = nid.id) where nid.key like ? and nm.typeId=8 and nm.sourceId=-1 and nm.languageCode='en'");           
        for(Entry <String,String> e : statements.entrySet()) {
            ps.setString(1, e.getKey() + ".name");
            ps.setString(2, e.getKey() + ".name_id");
            ps.setString(3, e.getValue());
            ResultSet rs = ps.executeQuery();
            while(rs.next()) {
                int id = rs.getInt("id");
                //String tag = rs.getString("tag");
                //String translation = rs.getString("translation");     
                System.out.println(id);
            }
        }



    } catch (SQLException e) {
        e.printStackTrace();
    }   
}

Answer 1

您设置列名称的方式错误，如下:

ps.setString(1, e.getKey() + ".name");
ps.setString(2, e.getKey() + ".name_id");

将在引号之间输入:

FROM "something.name" as

这是一个错误的语法。

相反，您必须直接设置名称，而无需像这样准备好的语句:

Connection connection = db.connect(db.getUrl_common_translation());
PreparedStatement ps = (PreparedStatement) connection.prepareStatement();
for (Entry<String, String> e : statements.entrySet()) {
    String query = "SELECT nm.id, nid.key, nm.name FROM " + e.getKey() + ".name" +" as nm "
            //----------------------------------------------^__________________^
            + "JOIN (" + e.getKey() + ".name_id" + " as nid) ON (nm.id = nid.id) "
            //-----------^_____________________^
            + "where nid.key like ? and nm.typeId=8 "
            + "and nm.sourceId=-1 and nm.languageCode='en'";
    ps.setString(1, e.getValue());
    ResultSet rs = ps.executeQuery(query);
    //------------------------------^^

但在此之前你必须检查名称不应该包含感染查询的内容(以避免语法错误和sql注入(inject))，因此你需要在之前创建一些 Controller