Consider am assigning the URL in the code below to a string, say
String link = "http://www.topix.com/rss/city/ellensburg-wa";
How should I use the string in the below code instead of the URL itself.
Note: am a beginner in java
stmt.executeQuery("select url from urls where url='http://www.topix.com/rss/city/ellensburg-wa'");
stmtR.executeUpdate("insert into urls values(21211,'http://www.topix.com/rss/city/ellensburg-wa','source',1,0)"
If you want to create a nice query use a prepared statement
PreparedStatement insertUrlStatement = con.prepareStatement("INSERT INTO urls VALUES(?, ?, ?, ?)");
//Replace the **first** "?" by an "id" variable content (containing an **int**)
insertUrlStatement.setInt(1, id);
//Replace the **second** "?" by the "url" variable content (containing a **String**)
insertUrlStatement.setString(2, url);
//Two other setXxx();
insertUrlStatement.executeUpdate()
stmt.executeQuery("select url from urls where url='" + link + "'");
stmtR.executeUpdate("insert into urls values(21211,'" + link + "','source',1,0)"
+ is Java's string concatenation operator.
See: http://download.oracle.com/javase/1.4.2/docs/api/java/lang/String.html
You should really consider using prepared statements (see other answers) if you are going to use this for SQL queries.
I've got to give my 2p on this one.
NEVER EVER Use string concatenation and SQL.
(ok that should perhaps read as never use sting concatenation and user input)
Follow the advice given above about using prepared statements.
Think about what would happen if you used string concatenation and SQL, when some nasty user enters the link
x'; DROP TABLE urls; --
Your code would look like
stmt.executeQuery("select url from urls where url='x'; DROP TABLE urls; --'");
Seriously don't even write a prototype that does this, bad code is always bad code and will end up being used. You don't want to be fired for writing one of the top ten vulnerabilities do you? www.drdobbs.com/web-development/224400744
Goto this site for a lot more examples and reasons why SQL string concatenation is BAD http://unixwiz.net/techtips/sql-injection.html
executeQuery? I think that ; is not accepted in a SQL statement. I could not do it using mysql-connector 5.1.5 ... and I remember it not working with older versions of Oracle.You can do that like this:
stmt.executeQuery("select url from urls where url='"+link+"'");
