does anybody know why an INSERT with sha512 is working without any problem:
String query = " insert into user (username, password, surname, lastname, email, admin)"
+ " values (?, sha2(?, 512), ?, ?, ?, ?)";
System.out.println("query: " + query);
// create the java statement
PreparedStatement ps = conn.prepareStatement(query);
ps.setString(1, newUser.getUsername());
ps.setString(2, getPsw());
ps.setString(3, newUser.getSurename());
ps.setString(4, newUser.getLastname());
ps.setString(5, newUser.getEmail());
......
......
and an UPDATE query not:
String query = "update user set password = sha2(?, 512) where id = "+getId()+")";
System.out.println("query: " + query);
// create the java statement
PreparedStatement ps = conn.prepareStatement(query);
ps.setString(1, psw_edit);
I get the following MySQLSyntaxErrorException:
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ')' at line 1
You have an extra closing brace ) in your UPDATE code
Try changing it to
String query = "update user set password = sha2(?, 512) where id = "+getId();
It seems that mySQL have a problem with password. Possibly it notices password as a mySQL Keyword. The solution is to write it on this way: password
But still a better solution is to hash a password directly in JAVA. Even better to create a salted hash first.
Related
This question already has an answer here:
insert query with varchar as data type for primary key
(1 answer)
Closed 8 years ago.
hello i have a problem with this resultset.
public ResultSet seleccionar(String id, String pass) throws SQLException {
PreparedStatement stmt;
String consulta = "SELECT iduser from personas ";
consulta+= " WHERE nombre=?";
consulta+= " AND pass= ?";
objetoConexion = Conexion.getInstance().getConnection();
stmt = objetoConexion.prepareStatement(consulta);
stmt.setString(1,id);
stmt.setString(2,pass);
ResultSet rs = stmt.executeQuery(consulta);
rs.first();
return rs;
this is my error
.mysql.jdbc.exceptions.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? AND pass= ?' at line 1
You need to check you spaces on your String consulta.
Have you considered using a StringBuffer and logging your SQL statements to the console so you can see what the queries look like?
You have to put a space before AND.
String consulta = "SELECT iduser from personas ";
consulta+= " WHERE nombre='?";
consulta+= "' AND pass='?'";
In my program I created a new database by reading a value from a TextField. The database creation was successful. But if there is already a database with the same name, it will result in error. So I decided to check whether the database is present or not before creation. How can I check it ?
I know how to check whether a table is present in a database or not. My code for it is -
preparedStatement = connect
.prepareStatement("SELECT count(*)FROM information_schema.tables\n" +
"WHERE table_schema = 'project' AND table_name = 'user'");
rs=preparedStatement.executeQuery();
rs.next();
int chk = rs.getInt(1);
if(chk!=1)
{
preparedStatement = connect
.prepareStatement("create table user (staffname varchar(30) primary key)");
preparedStatement.executeUpdate();
}
I do it in this way. So please tell me how to check a database is present or not in this way.
Will this code work ? -
preparedStatement = connect
.prepareStatement("SELECT count(*)FROM information_schema\n" +
"WHERE table_schema = "+dbName+"");
rs=preparedStatement.executeQuery();
rs.next();
int chk = rs.getInt(1);
if(chk!=1)
{
int resultset = statement.executeUpdate("create database " + dbName );
connect = DriverManager
.getConnection("jdbc:mysql://localhost:3306/"+dbName+"?"
+ "user=root&password=virus");
statement = connect.createStatement();
}
You can run this query:
SELECT COUNT(*)
FROM information_schema.tables
WHERE table_schema = '[database name]'
If the result is 1 it exists.
You can also use:
SHOW DATABASES LIKE 'dbname';
If it exists, you get one row.
Using a try-catch phrase I catch an error in the following code:
ResultSet rs = stmt.executeQuery("select * from 'user_tbl' where user_id = '"+user+"' ");
The error details are as follows:
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''user_tbl' where user_id = '12345678'' at line 1
Is there anything wrong with my syntax here? I'm using Netbeans as my IDE.
Single quotes are not required, try this:
ResultSet rs = stmt.executeQuery("select * from user_tbl where user_id = " + user);
If user_id is non-integer then enclose user variable in single quotes
You shouldn't have user_tbl inside ' marks, try removing them so it reads:
ResultSet rs = stmt.executeQuery(
"select * from user_tbl where user_id = '"+user+"' ");
String sql = ("insert into registration(pic) values(?) where email='"+Email+"' ");
i get error :error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where email='yyy#ymail.com'' at line 1
You have to use UPDATE query to pass it like
String sql = "UPDATE registration SET pic = ? WHERE email = '" + Email + "'";
Syntax for UPDATE query is
UPDATE table_name SET column_name = value;
Insert query format should be,
"insert into tablename (columnname) values(coulmnvalue)"
OR
"update registration set pic='' where email='"+Email+"'";
Yes. that is impossible.
Either you want:
insert into registration(pic) values(?)
Which will give you a new row;
Or you want an UPDATE:
UPDATE registration SET pic = ?
WHERE email = <EMAILYouWant>
Which will update an existing row where email = the record with the email you want to update the pic column.
conn = DriverManager.getConnection(connURL);
String sqlStr = "Select * from inventory where functions" + "like ? order by brand, model";
PreparedStatement pstmt = conn.prepareStatement(sqlStr);
pstmt.setString(1, "%" + search + "%");
ResultSet rs = pstmt.executeQuery();
Hi guys, i am having error with this code at line 2 and line 4. I believe that my coding contains errors.
I have a doubt that my SQL query is not correctly formatted. The pstmt.setString will set the search value to the ? in the SQL query.
The error:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''%null%' order by brand, model' at line 1
The syntax of your sql query declaration is wrong. That is why you're getting that error. Why are you including + in between ?
Try
conn = DriverManager.getConnection(connURL);//this is bad use a connection pool
StringBuilder sb = new StringBuilder().append("Select * from inventory where functions");
sb.append(" like ? order by brand, model");
String sqlStr = sb.toString().intern();//use intern if this function is used many times