java - 错误: MySQLSyntaxErrorException in a java-based web app

Question

public List<User> arrangeUsers(String option) {
    String query = "";
    if (option.equals("lastNameAsc")) {
        query = "SELECT * FROM ? ORDER BY lastName ASC;";
    } else if (option.equals("lastNameDesc")) {
        query = "SELECT * FROM ? ORDER BY lastName DESC;";
    } else if (option.equals("dobAsc")) {
        query = "SELECT * FROM ? ORDER BY dateOfBirth ASC;";
    } else if (option.equals("dobDesc")) {
        query = "SELECT * FROM ? ORDER BY dateOfBirth DESC;";
    }
    boolean listChoice;
    try (Connection conn = DriverManager.getConnection(URL, USERNAME, PASSWORD);
            PreparedStatement stmt = conn.prepareStatement(query);) {
        if (searchList.size() > 0) {
            stmt.setString(1, "search_results");
            searchList.clear();
            listChoice = true;
        } else {
            stmt.setString(1, "users");
            users.clear();
            listChoice = false;
        }
        ResultSet result = stmt.executeQuery();
        while (result.next()) {
            User user = new User();
            user.setFirstName(result.getString("firstName"));
            user.setLastName(result.getString("lastName"));
            user.setDob(result.getDate("dateOfBirth"));
            user.setPhoneNumber(result.getString("phoneNumber"));
            user.setEmail(result.getString("email"));
            user.setUserID(result.getInt("id"));
            if (listChoice) {
                searchList.add(user);
            } else {
                users.add(user);
            }

        }
    } catch (SQLException sqle) {
        System.err.println(sqle);
        sqle.printStackTrace();
        return null;
    }
    if (listChoice) {
        return searchList;
    } else {
        return users;
    }
}

上述方法返回错误:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''users' ORDER BY lastName DESC' at line 1 " error.

该方法应该根据客户端要求的顺序排列用户列表(表)。有什么建议吗？错误消息的原因是什么？如有必要，我准备提供任何其他详细信息。

Answer 1

表名不能用作参数。它必须是硬编码的。您可以执行以下操作:

public List<User> arrangeUsers(String option) {
    String query = "SELECT * FROM ";
    if (searchList.size() > 0) {
        query += "search_results ";
        searchList.clear();
        listChoice = true;
    } else {
        query += "users ";
        users.clear();
        listChoice = false;
    }

    if (option.equals("lastNameAsc")) {
        query += "ORDER BY lastName ASC;";
    } else if (option.equals("lastNameDesc")) {
        query +=  "ORDER BY lastName DESC;";
    } else if (option.equals("dobAsc")) {
        query +=  "ORDER BY dateOfBirth ASC;";
    } else if (option.equals("dobDesc")) {
        query += "ORDER BY dateOfBirth DESC;";
    }
    boolean listChoice;
    try (Connection conn = DriverManager.getConnection(URL, USERNAME, PASSWORD);
            PreparedStatement stmt = conn.prepareStatement(query);) {
        ResultSet result = stmt.executeQuery();
        while (result.next()) {
            User user = new User();
            user.setFirstName(result.getString("firstName"));
            user.setLastName(result.getString("lastName"));
            user.setDob(result.getDate("dateOfBirth"));
            user.setPhoneNumber(result.getString("phoneNumber"));
            user.setEmail(result.getString("email"));
            user.setUserID(result.getInt("id"));
            if (listChoice) {
                searchList.add(user);
            } else {
                users.add(user);
            }

        }
    } catch (SQLException sqle) {
        System.err.println(sqle);
        sqle.printStackTrace();
        return null;
    }
    if (listChoice) {
        return searchList;
    } else {
        return users;
    }
}

希望有帮助。