-1

I have the following line in my code :

int check1 = stmt3.executeUpdate("update ShopSystem.Grocery where g_id="+g_id+" set g_name="+g_name);

It is showing me the following error :

 You have an error in your SQL syntax; check the manual that corresponds to your MySQL     server version for the right syntax to use near 'where g_id=5 set g_name=Chikoo' at line 1

I think its because what is actually being passed to the SQL Server is : "update ShopSystem.Grocery where g_id=5 set g_name=Chikoo;

g_name is actually a String type. How should I pass that as a string in java print statement? Or is there any other mistake in my syntax?

user3868051
  • 1,147
  • 2
  • 22
  • 43

3 Answers3

2

You need to supply the quotes around the text value in your query, like so:

"update ShopSystem.Grocery set g_name='"+g_name +"' where g_id="+g_id+";

However, I would firmly advise you to use parameterized queries/prepared statements instead of concatenation.

PreparedStatement stmtUpdate = null;

String strUpdate = "update ShopSystem.Grocery set g_name= ? where g_id = ?";

stmtUpdate = yourconnection.prepareStatement(strUpdate);
stmtUpdate.setString(1,g_name);
stmtUpdate.setInt(2,g_id);
stmtUpdate.executeUpdate();

Note that the above code does not include exception handling and disposing resources, but it should get you started.

shree.pat18
  • 21,449
  • 3
  • 43
  • 63
  • your previous solution about adding '' single quotes dnt work... continued to give the same error but with prepared statement it worked.. thanks :) – user3868051 Jul 31 '14 at 11:06
  • That's another reason to trust prepared statements apart from security - you avoid the mess of having to include quotes etc. in the concatenated query. – shree.pat18 Jul 31 '14 at 11:07
1

I think g_name is a varchar type so you should enlose it with in quotes ('') like this

int check1 = stmt3.executeUpdate("update ShopSystem.Grocery set g_name='"+g_name+"' where g_id="+g_id );
SpringLearner
  • 13,738
  • 20
  • 78
  • 116
0

As shree.pat18 says I would advise you to use parameterized queries/prepared statements:

Anyway, you can use either simple quotes as:

"simple quote here -> ' text ' <-"

or double quotes as:

"double quote here -> \" text \" <-"
magodiez
  • 741
  • 2
  • 10
  • 23