Start using a PreparedStatement , it will prevent SQL injections . Read this SO Q&A for more.
You can do something like this :
String sql ="Select * from Payment where Payment_Date between ? and ? ";
PreparedStatement pstmt = conn.prepareStatement(query);
pstmt.setDate(1, date_1 );
pstmt.setDate(2, date_2 );
// date_1 and date_2 objects should be of type java.sql.Date
Make sure you set the correct parameter types in the setXXX()
methods. Remember if the data type for Payment_Date
is DATE
and related types, you need to set java.sql.Date in the setDate() method. If the data type of column is TIMESTAMP
, then use java.sql.Timestamp and setTimestamp() method.
Footnote :-
If you have a java.util.Date
object with you , you can convert that to java.sql.Date
as :
java.sql.Date sqlDateObject = new java.sql.Date(utilDateObject.getTime());