Beginner question about prepared statements...PLEASE help! :-)

Question

First let me say thanks for the assistance. This is probably really easy to do, but I'm new to JSP and can't seem to figure it out.
I want to dynamically populate a table that shows whether a particular person has an appointment at a given date and time with a user. To do this, I want to query the MySQL database for the lastname of the person with the appointment that occurs with the user at the year, month, date, and time, in question.
THE CODE BELOW DOESN'T WORK (obviously) BUT SOMEWHAT ILLUSTRATES WHAT I'M TRYING TO ACCOMPLISH:
<%
Driver DriverTestRecordSet = (Driver)Class.forName(MM_website_DRIVER).newInstance();
Connection ConnTestRecordSet = DriverManager.getConnection(MM_website_STRING,MM_website_USERNAME,MM_website_PASSWORD);
PreparedStatement StatementTestRecordSet = ConnTestRecordSet.prepareStatement("SELECT lastname FROM appts_pid1 WHERE user_id='<%=(((Recordset1_data = Recordset1.getObject(user_id))==null || Recordset1.wasNull())?"":Recordset1_data)%>' AND year='<%= yy %>' AND month='<%= months[mm] %>' AND date='<%= dates[dd] %>' AND appttime='16:15:00'");
ResultSet TestRecordSet = StatementTestRecordSet.executeQuery();
boolean TestRecordSet_isEmpty = !TestRecordSet.next();
boolean TestRecordSet_hasData = !TestRecordSet_isEmpty;
Object TestRecordSet_data;
int TestRecordSet_numRows = 0;
%>
The real problem comes in the prepared statement portion. If I build the prepared statement with static values like below, EVERYTHING WORKS GREAT:
PreparedStatement StatementTestRecordSet = ConnTestRecordSet.prepareStatement("SELECT lastname FROM appts_pid1 WHERE user_id='1' AND year='2002' AND month='October' AND date='31' AND appttime='16:15:00'");
But when I try to use dynamic values, everything falls apart. It's not that the values aren't defined, I use the user_id, year <%= yy %>, month <%= months[mm] %>, etc. elsewhere on the page with no problems. It's just that I can't figure out how to use these dynamic values within the prepared statement.
Thanks for reading this far and thanks in advance for the help!!!!

Answer 1

Hi PhineasGage
You are little bit wrong in your
your preparedStatement.
Expression tag within scriptlet tag is invalid.
Whenever you are appending the statement with
expression tag, append it with "+" and remove
expression tag.
Hopefully it will work
ThanksThanks for the response!
I know that the expression tag within scriptlet tag is invalid. I just need a workaround for what I want to do.
I'm unclear what you mean by "Whenever you are appending the statement with expression tag, append it with a "+" and remove expression tag".
Could you give an example?
In the meantime, I've been trying to digest the docs on prepared statements and have changed the code to look like:
PreparedStatement StatementTestRecordSet = ConnTestRecordSet.prepareStatement("SELECT lastname FROM appts_pid1 WHERE user_id= ? AND year= ? AND month= ? AND date= ? AND appttime='13:15:00'");
StatementTestRecordSet.setInt(1,1);
StatementTestRecordSet.setInt(2,2002);
StatementTestRecordSet.setString(3,"October");
StatementTestRecordSet.setInt(4,31);
Again, WITH THE STATIC VALUES, THIS WORKS FINE...but when I try to use expressions or variables like below, things don't work:
StatementTestRecordSet.setInt(2,<%= yy %>);
Obviously, I'm doing something wrong, but there has to be a way to use variables within the prepared statement.
ALSO, the values are being passed to this page via URL in the form:
samplepage?user_id=1&year=2002&month=October&date=31
Based upon this information, is there another way (outside of stored procedures in the db) to do what I want to do? I'm open to ideas.