PreparedStatement 和Statement用法区别:
String hidden = request.getParameter("action");
if(hidden != null && hidden.trim().equals("post")) {String userId = request.getParameter("userId") ;
String userName = request.getParameter("userName") ;
String password = request.getParameter("password");
String contactTel = request.getParameter("contactTel") ;
String email = request.getParameter("email");
Connection conn = DB.getConnect();
String sql = "update t_user set user_name = ?, password = ?, contact_tel = ?, email = ? where user_id = ? ";
PreparedStatement preStat = DB.getPreStat(conn, sql);
preStat.setString(1, userName);
preStat.setString(2, password);
preStat.setString(3, contactTel);
preStat.setString(4, email);
preStat.setString(5, userId);
preStat.close();
conn.close();
}
以上是PreparedStatement的用法,如果是Statement的话
String userId = "\"" + request.getParameter("userId") + "\"" ; //需要转义字符,使得变量传递给sql语句的值带有双引号
String userName ="\"" + request.getParameter("userName") + "\"";
String sql = "update t_user set user_name = " + userName + " where user_id = " + userId ;