sql timestamp java,在sql查询中使用java.sql.Timestamp对象

I am trying to run a query in java that uses a java.sql.Timestamp object as the date to compare with in the where clause.

Here is how the query string that is built in Java

String getTransactionsSQL = "Select transaction_seq " +

"From transactions ct " +

"Where id = 'ABCD'" +

"And ct.out_msg_timestamp" +

"<= to_date('" + parseDate.getTimeStamp() +"','YYYY-MM-DD HH:MI:SS..')" +

"order by transaction_seq";

The statement parseDate.getTimeStamp() returns a java.sql.TimeStamp object that contains a date. Here is an example output of System.out.println(parseDate.getTimeStamp());

2011-03-07 05:47:57.0

When i run the above query i get this error

java.sql.SQLException: ORA-01843: not a valid month

Any clues?

解决方案

Never use string concatenation to pass arguements to SQL commands (security risk: SQL injection)!