java - jdbc 代码中的错误 -> com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException : You have an error in your SQL syntax

Question

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException:您的 SQL 语法有错误；检查与您的 MySQL 服务器版本相对应的手册，了解在第 1 行“@gmail.com”附近使用的正确语法

不知道问题出在哪里

public List<UserModel> listUser(String emailParam) throws SQLException {
    List<UserModel> users = new ArrayList<>();

    Connection conn = null;
    PreparedStatement pre = null;
    ResultSet rs = null;

    // Get Connection
    conn = dataSource.getConnection();

    // fetch query
    String fetchUser = "SELECT * FROM user WHERE email = " + emailParam;
    pre = conn.prepareStatement(fetchUser);

    // execute query
    rs = pre.executeQuery();

    // fetch data using resultSet interface;
    while (rs.next()) {
        Integer id = rs.getInt("id");
        String firstName = rs.getString("firstName");
              ...
        String email = rs.getString("email");
        Boolean isActive = rs.getBoolean("isActive");
        Boolean isLibrarian = rs.getBoolean("isLibrarian");

        // insert into user constructor
        UserModel theUser = new UserModel(id, firstName, lastName, gender,
                department, idNo, contactNo, address, email, null,
                isLibrarian, isActive);

        // insert into ArrayList
        users.add(theUser);
    }

    // close connection
    close(conn, pre, rs);

    return users;
}

问题出在哪里，提前致谢。

Answer 1

错误就在这里，在listUser()中:

    // fetch query
    String fetchUser = "SELECT * FROM user WHERE email = " + emailParam;
    pre = conn.prepareStatement(fetchUser);

您在插入用户时成功地使用了准备好的语句，并且在查询时您需要在此处执行相同的操作:

    // fetch query
    String fetchUser = "SELECT * FROM user WHERE email = ?";
    pre = conn.prepareStatement(fetchUser);
    pre.setString(1, emailParam);