Help! PreparedStatement

Question

Hi, i'm currently working a JSP which gets an user input of a preparedStatement which looks like this:
"SELECT * FROM EMPLOYEE WHERE FirstName=? AND LastName=? AND City=?"
How can i get to another JSP page to ask the user to enter their values (For FirstName, LastName, City), so that it can replace the '?' in the preparedStatement??? And i can execute the preparedStatement...
Could someone pls help me out on this?? Coz i've tried out many times and i kept hitting errors...

Answer 1

You could try something like this. I did it this way
so I wouldn't have to mess with ps.setString. Just
keep in mind that this code is kind of messy, but it
should work.
PreparedStatement ps = null;
String tmp = "SELECT * FROM EMPLOYEE WHERE FirstName=?
AND LastName=? AND City=?";
int place = 0;
StringBuffer sb = new StringBuffer(tmp);
for(int i=0 ; ;i++) {
if((place = tmp.indexOf('?', place)) != -1)
e)) != -1) {
//Prompt user for ? value and get the
lue and get the value
// userValue is the value entered by
alue entered by user
sb.deleteCharAt(place);
sb.insert(place, "'" + userValue +
" + userValue + "'");
place++;
else {
break;
ps = con.prepareStatement(sb.toString());
It is pointless using a preparedstatment in this example, you may aswell just use a statment. 2 advantages of the preparedstatmet are:
i) The sql statment is precompiled onto the database server so the second and subsiquent time the preparedstatment is called performance is improved ( assuming the JDBC driver supports this ). If you replace the question marks before con.prepareStatement() the statment will be precompiled again and again rather than just once, that wouldnt be good for performance.
ii) When using ps.setString() ps.setInt() or whatever you dont have to worry about escape characters or adding ' characters to CHARACTER values but not to DECIMAL values, the implementation does this for you.
I dont know how you can that you are "messing with setString()" when the code above is the alternative.
Candy.. why dont you have a html form with a firstname / lastname and city field, read the values into Strings and call the use the preparedstatments setString(), what could be easier ;-)