oracle - JAVA SQL command not properly ended -
i have code:
buy.addactionlistener(new actionlistener() { @override public void actionperformed(actionevent actionevent) { int r; r = table.getselectedrow(); string num = (string) table.getvalueat(r, 0);//numele jucariei //string cop = (string) table.getvalueat(r, 3);//nr de bucati try { pq = stmt.executequery("select *" + "from buyid_view"); xv = stmt.executequery("select toyid, copies " + "from alldatas_view" + "where toyname ='"+num+"'"); int buyid = pq.getint("buyid"); int toyid = xv.getint("toyid"); int copies = xv.getint("copies"); copies = copies-1; callablestatement cstmt = con.preparecall("insert buy (buyid, toyid)" + "values (?,?)"); cstmt.setint("buyid", buyid); cstmt.setint("toyid", toyid); resultset rs = cstmt.executequery(); joptionpane.showmessagedialog(null, "you brought toy."); for(int = 0; < table.getrowcount(); i++) for(int j = 0; j < table.getcolumncount(); j++) table.setvalueat("", i, j); try { rs = stmt.executequery("update toys set copies "+ copies +"where toyid= '"+toyid+"'"); } catch (sqlexception e) { joptionpane.showmessagedialog(null, e.getmessage()); } int = 0; try { rs = stmt.executequery("select *"+ "from availablebooks_view"); } catch (sqlexception e) { e.printstacktrace(); } { try { if(rs.next()) { table.setvalueat(rs.getstring(1), i, 0); table.setvalueat(rs.getstring(2), i, 1); table.setvalueat(rs.getstring(3), i, 2); i++; while(rs.next()) { table.setvalueat(rs.getstring(1), i, 0); table.setvalueat(rs.getstring(2), i, 1); table.setvalueat(rs.getstring(3), i, 2); i++; } } } catch (sqlexception e) { joptionpane.showmessagedialog(null, e.getmessage()); } } } catch (sqlexception e) { if(e.getmessage().contains("you have pay!")) warning(frame, "you didn't pay products"); else warning(frame, e.getmessage()); } } });
when compile program don't have error when run , click on buy button gives me error saying "ora-00933: sql command not ended".
when building sql statements strings must ensure there spaces spaces needed.
rs = stmt.executequery("select *"+ "from availablebooks_view");
the statement sending
select *from availablebooks_view
which invalid syntax. have problem in several places in code.
however, have larger issue results building sql statements piecemeal. leaves open sql injection , should rewrite code use prepared statements , parameters instead.
Comments
Post a Comment