Why am i getting an illegal character error on an sql query?

Question

The error states that the index of the illegal character is 6 but the 6th character is the space after SELECT

    static final String JDBC_DRIVER = "com.mysql.jdbc.Driver";
static final String DB_URL = "jdbc:mysql://sql3.freemysqlhosting.net:3306/";

static final String USER = "****";
static final String PASS = "****";

public JSONArray getLocation(ArrayList postParameters)
{
    Connection conn = null;
    HttpEntity httpEntity = null;
    try{

        Class.forName(JDBC_DRIVER);

        System.out.println("Connecting ");
        conn = DriverManager.getConnection(DB_URL, USER, PASS);
        System.out.println("Connection successful.");

        String sql = "SELECT * FROM locations WHERE locTag LIKE '%"+postParameters+"%'";

        DefaultHttpClient httpClient = new DefaultHttpClient();

        HttpPost httpPost = new HttpPost(sql);
        httpPost.setEntity(new UrlEncodedFormEntity(postParameters,"UTF-8"));
        HttpResponse httpResponse = httpClient.execute(httpPost);
        httpEntity = httpResponse.getEntity();

i am then getting

java.lang.IllegalArgumentException: Illegal character in path at index 6: select * FROM locations WHERE locTag = '%[locTag=fast]%'

I have also tried encoding but no luck.

If you're trying to do an SQL wildcard search you might want to try use `LIKE` instead of `=`, as in `"SELECT * FROM locations WHERE locTag LIKE '%"+postParameters+"%'"`. Share and enjoy. — Bob Jarvis - Слава Україні, May 13 '15 at 18:45
@attaboy182 - I don't think a semicolon is required when executing the query through JDBC. — Bob Jarvis - Слава Україні, May 13 '15 at 18:46
sorry my mistake i was trying a few things when i added the "=", the proper query does contain "LIKE" — sr90, May 13 '15 at 18:46
Hmmm...what does "in path" mean in the error message? I suspect it's not referring to the statement text. Could this be an error in the URL? Please edit the question and include the Java code being used to invoke this statement, including the code used to establish the JDBC connection. Thanks. — Bob Jarvis - Слава Україні, May 13 '15 at 18:53
[see this before you continue down the string concat path which is really bad](http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work) — , May 13 '15 at 19:01

score 0 · Answer 1 · answered May 14 '15 at 07:13

You are trying to execute an SQL query as a HTTP request. That makes no sense at all. The HttpPost constructor expects an URI, a select statement is not a URI.

You either need to use JDBC to execute the query, or you need to GET or POST a URI. I can't tell from your code what you are actually trying to do though.

Why am i getting an illegal character error on an sql query?

1 Answers1