Java & Acces: pass boolean values

Question

Ok I'm totally new at this so the following text will hopefully be understandable. I hope you guys can give me a hand over here.
The case:
I'm making a java function that has to create a new user of my database. This user is supposed to get a name, a password and can have 4 functions (Administrator, Author, Reader, Coreader).
To identify the 4 functions i used a checkbox in my database. So when the box is checked the person is a Admin/author/... Now I was wondering how i can use Java (using a query) to set these values checked or non-checked.
I thought I'd use booleans, however, my compiler says there is a General Error (all the names of the columns are right, so that's not the deal, my database is working properly and such, ...)
So here's my code:
(note that i used these marks ' ' here for the booleans, i tried all kinds of things such as dropping them, using them, ... it doesn't seem the problem...)
public void addNewUser(String username, String password, boolean admin, boolean author, boolean reader, boolean coreader)
String query1 = "UPDATE user SET username = '" + username + "' AND password = '"
+ password + "' AND administrator = '" + admin + "' AND author ='" + author
+ "' AND reader ='" + reader + "' AND coreader ='" + coreader + "'";
try
stmt = global.createStatement();
stmt.executeUpdate(query1);
global.showMessage("The new user, " + username + ", has been added successfuly", "Succesfuly added");
catch(Exception e)
global.showError("An error has occured while connecting to the database" + e.toString(), "SQL Error");
finally
global.closeConnection();
Hope you guys can help. Thanks a lot!

Answer 1

It's possible to do this; it's just that your SQL syntax is completely wrong. An SQL UPDATE statement looks as follows:
UPDATE table SET column1 = value1, column2 = value2, column3 = value3 WHERE expression
You're using 'AND' instead of commas, which is the first thing that goes wrong. The second thing that goes wrong is that you're building the SQL statement from bits of string and values. This is a habit that many novice programmers use, and open the door wide for SQL injection attacks. I you do this sort of thing on a web site, you could end up with your customers' credit card details being exposed.
But because you're just passing the boolean values into the string, they get expanded to a string value, hence TRUE or FALSE. However, because they are string literals, they should be surrounded by single quotes.
This brings us to the third problem: you're using an UPDATE statement to insert a new record. Use an INSERT statement instead.
It would be better to use a PreparedStatement. In this case, your code would look as follows:
PreparedStatement stmt =
    global.prepareStatement( "INSERT INTO user " +
            "( username, password, administrator, author, reader, coreader ) " +
            "VALUES ( ?, ?, ?, ?, ?, ? )" );
    stmt.setString( 1, username );
    stmt.setString( 2, password );
    stmt.setBoolean( 3, admin );
    stmt.setBoolean( 4, author );
    stmt.setBoolean( 5, reader );
    stmt.setBoolean( 6, coreader );I have no idea whether this will work: I don't know Access, and booleans are not a standard feature of SQL. I also don't know whether Microsoft have created their own flavour of SQL, as they are wont to do with any standard.
All in all, though, you have to really work on your SQL. Three major mistakes in such a simple piece of code means that you don't understand SQL syntax. You may copy and paste this for your assignment, but unless you understand what you're actually doing, you're going to run into trouble again very soon.
- Peter