Using parameter in select statement

Question

I was trying to parameterize value in Preparedstatement as below like

PreparedStatement ps = Connection.prepareStatement("select col_a,? from TABLE_A");
ps.setString(1,"myValue");
ps.execute();

I want the following return

COL_A    myValue
-----------------
val1     myValue
val2     myValue

which is comparable to a plain sql as below.

select col_a,'myValue' 
from TABLE_A

possible duplicate of Variable column names using prepared statements — Forgotten Semicolon
– Forgotten Semicolon, Commented Apr 16, 2012 at 19:02
Hi folks thank you for your response... I was initially getting errors but somehow in DB2, it does work. I have no idea why and how but it does... — user1337045
– user1337045, Commented Apr 18, 2012 at 15:08

Oded · Accepted Answer · 2012-04-16 19:01:08Z

2

You can't parametrize column names.

For dynamic column names you will need to use dynamic SQL, which can open you up to SQL injection.

answered Apr 16, 2012 at 19:01

Oded

501k102 gold badges900 silver badges1k bronze badges

Sign up to request clarification or add additional context in comments.

1 Answer 1