jdbc and mysql

HI guys:

I need urgent help:

I am developing online banking system the new customer inter his details into register.html page, I have customers and accounts table in my database, when the new customer register his/her details stored in customers table and the system generate unique customerid and accountid for the customer, but i have exception throw said:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'where (customers.'null'=accounts.'null')' at line 1

This my code how do i sort this problem please help:

[code]

import java.io.*;

import javax.servlet.*;

import javax.servlet.http.*;

import java.util.*;

import java.sql.*;

import java.awt.*;

import java.lang.Math;

public class register extends HttpServlet

{

Connection connection;

String name, customerid, address, email, password, accountid,description;

private Connection con = null;

public Statement s = null;

private ResultSet rs = null;

String bigDecimal;

public String URL = "org.gjt.mm.mysql.Driver";

public void init()

{

try

{

Class.forName("org.gjt.mm.mysql.Driver");

Connection con = DriverManager.getConnection

("jdbc:mysql://urlport/user","user","password");

String conStr = "jdbc:mysql://("urlport/user","user","password"&jdbcCompliantTruncation=false";

Statement stmt = con.createStatement();

stmt.executeUpdate( "CREATE TABLE customers (" +

"nametextNOT NULL, "+

"customerid int (10) NOT NULL primary key auto_increment, "+

"addresstext (25) NOT NULL, "+

"emailtext (20) NOT NULL, "+

"passwordtext (10) NOT NULL,"+

"description CHAR (20) NOT NULL,"+

")" );

stmt.executeUpdate( "CREATE TABLE accounts (" +

"customeridint (10)NOT NULL, "+

"accountidint (10) NOT NULL primary key auto_increment, "+

"balance text (10) NOT NULL, "+

"overdrafttext (10) NOT NULL,"+

"descriptionCHAR (20) NOT NULL, "+

")" );

}

catch (Exception e)

{

e.printStackTrace();

}

}

public void doGet(HttpServletRequest request, HttpServletResponse response)

throws ServletException, IOException

{

PrintWriter out = response.getWriter();

response.setContentType("text/html");

out.println("<HTML>");

out.println("<BODY>");

String name = request.getParameter("name");

String address = request.getParameter("address");

String email = request.getParameter("email");

String password = request.getParameter("password");

String account_desc = request.getParameter("description");

String balance = request.getParameter("balance");

String overdraft = request.getParameter("overdraft");

try // try to add data to the database

{

Class.forName("org.gjt.mm.mysql.Driver");

Connection con = DriverManager.getConnection

("jdbc:mysql://urlport/user","user","password");

Statement st = con.createStatement();

st.executeUpdate("insert into customers ("+"name,address, email,password,description,customerid)values('"+name+"','"+address+"', '"+email+"', '"+password+"','"+description+"', customerid)");

st.executeUpdate("insert into accounts ("+"customerid,accountid,balance, overdraft, description) values(customerid,accountid, '"+balance+"', '"+overdraft+"','"+description+"')where (customers.'"+customerid+"'=accounts.'"+customerid+"')");

Message was edited by:

hatim

[3701 byte] By [hatima] at [2007-10-2 19:27:29]
# 1
you are concatinating variable values in to sql statements. Thats bad practice.You PreparedStatement and use setXXX methods to set the values
LRMKa at 2007-7-13 21:13:44 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 2

Ehere is an example

String s = "insert into customers (" +

"name,address, email,password,description,customerid)" +

"values ('?,?,?,?,?,?) ";

PreparedStatement ps = con.prepareStatement(s);

ps.setString(1,name);

ps.setString(2,address);

ps.setString(3,email);

ps.setString(4,password);

ps.setString(5,description);

ps.setString(6,customerid);

ps.executeUpdate();

LRMKa at 2007-7-13 21:13:44 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...
# 3

Yes, it is bad practice and can open the door to an SQL injection attack. By all means, use parameter place-holders and the setXyz(int, xyz) methods to do parameter binding.

Or, better yet, did you take a look at Hibernate or SQLMaps? Both will save you a lot of headaches in the future.

Good luck

gbilodeaua at 2007-7-13 21:13:44 > top of Java-index,Enterprise & Remote Computing,Web Tier APIs...