can i write my Sql query in this way

Question

I am wondering can i insert table name in this format

String update = "UPDATE ? SET Status = ? WHERE Name = ?";
stmt.setString(1,tableName);
stmt.setString(2,status);
stmt.setString(3,name);

same for insert and delete statements?

you can but only using dynamic SQL which this isn't doing. dynamic SQL does open you to SQL injection if you're not careful. — xQbert, Mar 13 '13 at 12:31
If you need this, I suspect that the data structure is not properly done... Not sure, as I can't see what you have nor what you are trying to achieve, but if you have to replicate the exact same query over so many tables you'd like to have a generic prepared statement for it, there might be something bad going on... — ppeterka, Mar 13 '13 at 12:35
possible duplicate of [Can PHP PDO Statements accept the table name as parameter?](http://stackoverflow.com/questions/182287/can-php-pdo-statements-accept-the-table-name-as-parameter) — david strachan, Feb 27 '14 at 20:56

score 5 · Accepted Answer · answered Mar 13 '13 at 12:40

No.

The reason you place question marks in the query (aside from protection against SQL injection) is so that the database can prepare the statement once and use that prepared statement with different parameters. It wouldn't be able to prepare a statement if it doesn't know what table(s) you are using.

score 3 · Answer 2 · answered Mar 13 '13 at 12:36

The short answer is no. But you can do it this way:

String update = "UPDATE " + tableName + " SET Status = ? WHERE Name = ?";
...
stmt.setString(1,status);
stmt.setString(2,name);

Be aware of the SQL injection though. Be sure your tableName comes from the secure source.

score 1 · Answer 3 · answered Mar 13 '13 at 12:36

Normally, you would do this as shown below...

    String sql = "UPDATE " + tableName " SET Status = ? WHERE Name = ?";

    PreparedStatement stmt = null;

    try {
        stmt = connection.prepareStatement(sql);
        stmt.setString(1, status);
        stmt.setString(2, name);
        stmt.executeUpdate();
    } finally {
        if (stmt != null) {
            stmt.close();
        }
    }

score 0 · Answer 4 · answered Mar 13 '13 at 12:59

No you cann't do this because you are definitely using a prepared statement. The reason you can not do this is PreparedStatement is pre-compiled so it needs the table which you are modifing (its data using DML) or structurally (using DDL). If you don't mention the table table name how the statement is going to be pre-compiled?

If you want you can use dynamic SQL but in that case you don't have to use PreparedStatement you can use it using a simpler implementation Statement.

Hope this is helpful !!

can i write my Sql query in this way

4 Answers4