Concat java variable to a MySql select statement and exeucte

Question

Hi,
I am trying to append a variable to a MySql select statement.
Overview: I need to retrieve data from a MySql database with a java variable as a reference and select the data in the database based on that variable.
CODE THAT I CURRENTLY HAVE:
// Declare variables
Connection conn = null;
Statement st = null;
Resultset rs2 = null;
String st2 = null;
String keyid = null;
// Connect to database
try {
      Class.forName("org.gjt.mm.mysql.Driver").newInstance();
      conn = DriverManager.getConnection("jdbc:mysql://" + mysql_host + ":3306/" + mysql_database, mysql_login, mysql_password);
      st = conn.createStatement();
      // Select data in Database with hanging equal sign
      st2 = ("SELECT * FROM table WHERE keyid= ");
      // Append keyid to hanging equal sign of select statement
      rs2 = st.executeQuery(st2 + keyid);
}This is not working when I try to display the data.

Answer 1

What is not working about it? Is there an error message? Stack Trace?
Where do you get the value of keyId from?
I would suggest that you use a prepared statement rather than building up a sql string like this. It prevents sql injection attacks
// Declare variables
Connection conn = null;
PreparedStatement stmt = null;
Resultset rs2 = null;
String sql= null;
String keyid = null;
// Connect to database
try {
      Class.forName("org.gjt.mm.mysql.Driver").newInstance();
      conn = DriverManager.getConnection("jdbc:mysql://" + mysql_host + ":3306/" + mysql_database, mysql_login, mysql_password);
      // Select data in Database with place holder for parameter
      sql = "SELECT * FROM table WHERE keyid= ?";
       // prepare the statement
      stmt = conn.prepareStatement(sql);
      // set the value of key id to use with the query
      stmt.setString(1, keyId);
      // run the query
      rs2 = st.executeQuery();
catch (Exception e){
  System.out.println("An error occurred " + e.getMessage());
  e.printStackTrace();
finally{
  if (rs2 != null) try { rs2.close(); } catch(SQLException ex){}
  if (stmt != null) try { stmt.close(); } catch(SQLException ex){}
  if (conn != null) try { con.close(); } catch(SQLException ex){}
}