Java.sql - Interface Statement

Question

Hi
I'm new to Java and need help on the following code.
statement.executeQuery("SELECT * From titles");when I executed the above code, it showed me the all the records from the title table. But I want to write an SQL query like this with executeQuery method ,
statement.executeQuery("SELECT * from authors where firstName =    authorFirstName")authorFirstName is a variable and that value is obtained from user input, and I want to check if the value in the variable "authorFirstName" exists in the firstName column in the authors database.
If I write the query in the command prompt(mySql), it will be - SELECT * from authors where firstName =   'tom';but how can I write this with the method executeQuery() giving the variable name authorFirstName instead of 'tom'?
Thanks in advance
Edited by: shana10 on May 8, 2009 3:14 AM

Answer 1

Yes, definitely use a PreparedStatement.
But to answer your confusion as to how to get a variable into that select string (if you weren't using a PS), you'd do it just like you put a variable into any other string:
String query = "select * from foo where name = '" + name + "'";But don't do that. Use a PS and a ? parameter.