Use Variable in SQL stement instead of TableName

Question

I have two database table with same attributes. I want to use two sql statments one read from table n 2nd update table.

String tableName = "";
String value = request.getParameter("PageId");
if(value=="Alflah"){
    tableName = "PARKTABLEONE";
}
if(value=="ParkN"){
    tableName = "PARKTABLE";
}

One Statment:

ResultSet rs= st.executeQuery("Select * From  " +tableName+ " WHERE ID = \'"+ login + "\' ");

2nd Statement:

String query = "update " + tableName + " set Place1 = ?, Place2 = ? WHERE ID = \'"+ login + "\'";

So, I want to use TableName variable here. For example if tablename is Alflah it shoud read from alflah Is it possible or not? please correct me where is my mistake??

Aside from anything else, you shouldn't be comparing strings like that - see http://stackoverflow.com/questions/513832/how-do-i-compare-strings-in-java — Jon Skeet, Jan 02 '17 at 18:49
Side note: Unrelated to `tableName`, your code is wide open to [SQL injection attacks](http://bobby-tables.com) and innocuous non-attack values. Use parameterized queries. — T.J. Crowder, Jan 02 '17 at 18:49
@JonSkeet: Well-spotted, that's probably what's wrong. I've already voted, but you could dupehammer it. — T.J. Crowder, Jan 02 '17 at 18:49
Syntax error when I run this code: Encountered "WHERE" at line 1, column 17. root cause — bc120403236 Rakhshinda Jabeen, Jan 02 '17 at 18:57
Why is the backslash needed in front of single quotes? They don't need to be escaped. This might cause an SQL exception as far as I know. — Kishore Bandi, Jan 02 '17 at 19:10
ok so, how to fix it?? Last part is correct just how to use table name in form of variable is needed for me. please help how to do it? — bc120403236 Rakhshinda Jabeen, Jan 02 '17 at 19:35

score 1 · Accepted Answer · answered Jan 02 '17 at 20:44

1

TableName is empty, that's why it says error at column 17. If WHERE starts at 17, then it must be empty, just count the characters

answered Jan 02 '17 at 20:44

Christoph G

555
2
8

its working now, I have set tableName value in previous jsp and then got this value using request.getParameter("tableName"); – bc120403236 Rakhshinda Jabeen Jan 03 '17 at 06:41

Use Variable in SQL stement instead of TableName

1 Answers1