insert problem with mysql

[espresso]

I have a mysql table with two columns, DeptNo and DeptName. I am
making inserts from java code with the following where the variables
are populated with text from a jTextfield:

sqlString = "INSERT INTO department SET DeptNo= '" + deptno + "' + ','
+ 'DeptName=' + '" + deptname + "'";
int result=0;

result= dbc.executeUpdate(sqlString);

Each time I do this insert I get a result of one--successfull
insert--but only the deptno value gets inserted into the database. The
DeptName field is blank.
I have also tried this with a prepared statement to test if there is
something wrong with my sqlString, but I get the same result.

Any ideas what is happening here.

Thanks

 

[Ryan Stewart]

I have a mysql table with two columns, DeptNo and DeptName. I am
making inserts from java code with the following where the variables
are populated with text from a jTextfield:

sqlString = "INSERT INTO department SET DeptNo= '" + deptno + "' + ','
+ 'DeptName=' + '" + deptname + "'";
int result=0;

result= dbc.executeUpdate(sqlString);

Each time I do this insert I get a result of one--successfull
insert--but only the deptno value gets inserted into the database. The
DeptName field is blank.
I have also tried this with a prepared statement to test if there is
something wrong with my sqlString, but I get the same result.

So if you get the same result both ways....doesn't that make you think there
might be something wrong with your SQL? Have you checked the String to see
what you're trying to execute? If so, you'd find this:
INSERT INTO department SET DeptNo= '5' + ',' + 'DeptName=' + 'blah'


If you expect that to work, you need to read up on SQL.

 

[Sudsy]

Ryan Stewart wrote:

So if you get the same result both ways....doesn't that make you think there
might be something wrong with your SQL? Have you checked the String to see
what you're trying to execute? If so, you'd find this:
INSERT INTO department SET DeptNo= '5' + ',' + 'DeptName=' + 'blah'


If you expect that to work, you need to read up on SQL.

Further, that's not even the correct standard syntax for an SQL insert
statement. It should look like this:
INSERT INTO tablename [ ( columname [ , ... ] ) ]
VALUES ( value [ , ... ] )

As Ryan noted, you should really study SQL syntax.

 

[Tony Morris]

sqlString = "INSERT INTO department SET DeptNo= '" + deptno + "' + ','
Looks like a good candidate for a SQL injection attack (i.e. broken code).
You might want to look at using a java.sql.PreparedStatement.

--
Tony Morris
(BInfTech, Cert 3 I.T.)
Software Engineer
(2003 VTR1000F)
Sun Certified Programmer for the Java 2 Platform (1.4)
Sun Certified Developer for the Java 2 Platform