Select with prepared statements Java

Question

I just learned about prepared statements and now I'm trying to include them to my java program. However I get an exception when I try to add to values to the statement( table and name). When I prepare with only one variable it works fine. What am I doing wrong?

[SQLITE_ERROR] SQL error or missing database (near "?": syntax error)

String sql="SELECT * FROM ? WHERE name = ?";
    try {
        PreparedStatement preparedStatement = connection.prepareStatement(sql);
        preparedStatement.setString(1, table);
        preparedStatement.setString(2, name);
        ResultSet checkTable = preparedStatement.executeQuery();

because table is a variable, there can be 2 different tables — Lau, May 07 '16 at 18:43

score 3 · Accepted Answer · edited May 23 '17 at 12:16

3

That's not how prepared statements work. Oddly enough, you can't use placeholders for table names. The solution being to use something like:

String sql = String.format("SELECT * FROM %s WHERE name = ?", table);

... and proceed with the rest of your code.

edited May 23 '17 at 12:16

Community

1
1

answered May 07 '16 at 18:47

hd1

33,938
5
80
91

It is not odd that you can't, parameters are for passing values, a table name is not a value. – Mark Rotteveel May 08 '16 at 09:53

β.εηοιτ.βε · Answer 2 · 2016-05-07T18:48:02.250

0

Prepared statement are for values, a table name is not considered as being a value. So what you try to achieve is not possible.

That would work, though :

String sql="SELECT * FROM any_table_name WHERE name = ?";
try {
    PreparedStatement preparedStatement = connection.prepareStatement(sql);
    preparedStatement.setString(1, name);
    ResultSet checkTable = preparedStatement.executeQuery();
} catch (Exception e) {}

edited May 07 '16 at 18:48

answered May 07 '16 at 18:45

β.εηοιτ.βε

33,893
13
69
83

Thanks, what should i use if I need to pass table name as an argument than? – Lau May 07 '16 at 18:47

Aditya · Answer 3 · 2016-05-07T18:56:37.187

0

Prepared statements are for column values not table names. You should do it as follows.

String sql = "SELECT * FROM `" + table + "` WHERE name = ?";

edited May 07 '16 at 18:56

answered May 07 '16 at 18:47

Aditya

913
2
7
18

Select with prepared statements Java

3 Answers3