Inserting all manner of characters into database

Question

Hello friends,
Consider this code snippet of mine:
String sentence = "My name is nameless aka 'anonymous' or \"anonymous\" ('did I hear that? Maybe!! now where were we?') -\"yawn! Am bored..."; PreparedStatement statement = connection.prepareStatement("insert into tenonly(name) values('" + sentence + "')"); statement.executeUpdate();  // THIS IS LINE 38{code} And consider the stack trace: {code}init: deps-jar: Compiling 1 source file to /home/arthur/portal/MaintainTenEntries/build/classes compile: run: java.sql.SQLException: No value specified for parameter 1         at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:910) DONE         at com.mysql.jdbc.PreparedStatement.fillSendPacket(PreparedStatement.java:1534)         at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1375)         at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1318)         at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1303)         at maintaintenentries.Main.main(Main.java:38) BUILD SUCCESSFUL (total time: 13 seconds){code} Could anyone please inform me of my  wrong turn? Thanks                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

Answer 1

Jamwa wrote:
Hello friends,
Consider this code snippet of mine:
String sentence = "My name is nameless aka 'anonymous' or \"anonymous\" ('did I hear that? Maybe!! now where were we?') -\"yawn! Am bored...";
PreparedStatement statement = connection.prepareStatement("insert into tenonly(name) values('" + sentence + "')");
statement.executeUpdate();  // THIS IS LINE 38{code}Consider how you're misusing PreparedStatement. It escapes Strings properly for you, yet you aren't using it to do so.
The right way is:
{code}
String sentence = "My name is nameless aka 'anonymous' or \"anonymous\" ('did I hear that? Maybe!! now where were we?') -\"yawn! Am bored...";
PreparedStatement statement = connection.prepareStatement("insert into tenonly(name) values(?)");
statement.setString(1, sentence);
statement.executeUpdate(); // THIS IS LINE 38