sql拼接
我的參數(shù)沒亂碼，sql卻成了select ID,COMMAND,DESCRIPTION,CONTENT from message where 1=1 and COMMAND = ? ? select ID,COMMAND,DESCRIPTION,CONTENT from message where 1=1 and DESCRIPTION like '%' ? '%' 參數(shù)就沒替換上去，這是為什么?那位大神能幫我解決一下
模棱0
2016-10-24
2 回答
舉報
0/150
提交
取消
2016-10-26
req.setCharacterEncoding("utf-8");
try {
String command = req.getParameter("command");
String description = req.getParameter("description");
req.setAttribute("command", command);
req.setAttribute("description", description);
Class.forName("com.mysql.jdbc.Driver");
Connection connection = (Connection) DriverManager.getConnection("jdbc:mysql://localhost:3306/micro_message", "root", "root");
StringBuilder sql = new StringBuilder("select ID,COMMAND,DESCRIPTION,CONTENT from MESSAGE where 1=1");
List<String> paramList = new ArrayList<String>();
if (command != null && !"".equals(command.trim())) {
sql.append(" and COMMAND = ?"); //先把拼接的模版做好，最后在通過%把傳過來的參數(shù)加進去
paramList.add(command);
} ? ? ? ? ? ? ? ? ? ?
if (description != null && !"".equals(description.trim())) {
sql.append(" and DESCRIPTION like '%' ? '%'");
paramList.add(description);
}
PreparedStatement statement = (PreparedStatement) connection.prepareStatement(sql.toString());
System.out.println(paramList.size());
for (int i = 0; i < paramList.size(); i++) {
statement.setString(i+1, paramList.get(i));//sql語句中出現(xiàn)的？是從第一個開始數(shù)
}
System.out.println(sql.toString());
ResultSet resultSet = statement.executeQuery();
List<Message> messageList = new ArrayList<Message>();
while(resultSet.next()){
Message message = new Message();
messageList.add(message);
message.setId(resultSet.getString("ID"));
//System.out.println(resultSet.getString("ID"));
message.setCommand(resultSet.getString("COMMAND"));
message.setDescription(resultSet.getString("DESCRIPTION"));
message.setContent(resultSet.getString("CONTENT"));
}
req.setAttribute("messageList", messageList);
2016-10-25
把代碼貼出來