Syntax error trying to create an sql table from Java

Question

I want to create a table and this table's name will be inserted from a textfield. However when I run the query it's giving me an error, any help on this one? I'll paste the code here:

public boolean CreateTable() {
  TableNumber = jTextField4.getText();

  try {            
    String password = null;
    String s = "CREATE TABLE '"+TableNumber+ "' (Item char(50),Price char(50))";

    ConnectionForOrders();
    stmt = conn.createStatement();
    stmt.executeUpdate(s);

    boolean f = false;
    ConnectionForOrdersclose();

Please fix your code formatting. Additionally, please provide more details on the error you are getting. — VeeArr
– VeeArr, Commented Jun 9, 2010 at 21:31
only YOU can prevent SQL injection! Be careful when you take a variable directly from a text field — colinmarc
– colinmarc, Commented Jun 9, 2010 at 21:34
Your tags can/do say both SQL and Java. The fact that you post means you have a question. Please think about your title a little more next time. — Thomas M. DuBuisson
– Thomas M. DuBuisson, Commented Jun 9, 2010 at 21:36
@colinmarc & OP - not only be careful, never ever do it this way. If you have to take parts of your SQL statement from user input then check the input (here:TableNumber) for malicous code/fragments — Andreas Dolk
– Andreas Dolk, Commented Jun 9, 2010 at 21:39

Joel Coehoorn · Accepted Answer · 2010-06-09 21:37:05Z

3

I'll start by assuming your '" gaff is a typo because it shouldn't even compile that way (I edited the question to fix it for those that come later).

That aside, you don't enclose tables names in single quotes. It's not:

CREATE TABLE 'tablename' ( ... )

You just write:

CREATE TABLE tablename ( ... )

But you shouldn't even do that much, because you're getting your tablename from a text field. What's to prevent someone from entering something like this in that text field:

a(b int);DROP TABLE users;--

(Assuming of course that you have a users table somewhere). It's important to remember that an attacker could enter any arbitrary sql after that first ;, and your database will blindly run it.

answered Jun 9, 2010 at 21:37

Joel Coehoorn

418k114 gold badges582 silver badges820 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Roland Bouman · Accepted Answer · 2010-06-09 21:34:21Z

1

Is TableNumber well...a number? If it is, it's probably causing a syntax error.

answered Jun 9, 2010 at 21:34

Roland Bouman

32.1k8 gold badges69 silver badges69 bronze badges

Comments

Mike · Accepted Answer · 2010-06-09 21:34:24Z

1

Looks like the apostrophe and quotation mark are inverted around TableNumber (the right side), which would produce a compiler error.

answered Jun 9, 2010 at 21:34

Mike

5361 gold badge4 silver badges10 bronze badges

Collectives™ on Stack Overflow

Syntax error trying to create an sql table from Java

3 Answers 3

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related