java mysql预处理,如何在Java中使用预处理语句进行select查询？

I had tried several times using prepared statements but it returns SQL exception. here is my code:

public ArrayList name(String mobile, String password) {

ArrayList getdata = new ArrayList();

PreparedStatement stmt = null;

try {

String login = "select mobile, password from tbl_1 join tbl_2 on tbl_1.fk_id=2.Pk_ID where mobile=? and password=?";

String data = "select * from tbl_2 where password='" + password + "'";

PreparedStatement preparedStatement = conn.prepareStatement(login);

preparedStatement.setString(1, mobile);

preparedStatement.setString(1, password);

ResultSet rs = preparedStatement.executeQuery(login);

Statement stmts = (Statement) conn.createStatement();

if (rs.next()) {

System.out.println("Db inside RS");

ResultSet data = stmts.executeQuery(data);

while (data.next()) { /* looping through the resultset */

getdata.add(data.getString("name"));

getdata.add(data.getString("place"));

getdata.add(data.getString("age"));

getdata.add(data.getString("job"));

}

}

} catch (Exception e) {

System.out.println(e);

}

return getdata;

}

While running this, I got the following SQL exception:

com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? and password=?' at line 1.

Any suggestion to make this work?

any piece of code is appreciated.

解决方案

You need to use:

preparedStatement.executeQuery();

instead of

preparedStatement.executeQuery(login);

when you pass in a string to executeQuery() that query is executed literally and thus the ? is send to the database which then creates the error. By passing query string you are not execution the "cached" prepared statement for which you passed the values.