JSP-JDBC Help

Question

Hi everone,
Can you please let me know how can I insert "-" or "+" into my sql Database. for example the code bellow, imagin c =10, taken from the user, I want to insert C as "-10" or "+10" into databse
String str= "insert into table values ('"+a+"', '"+b +"','"+-c+"')"; //c=-10
String str= "insert into table values ('"+a+"', '"+b +"','"+ +c+"')";//c= +10
[/code
Thank you]                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           

Answer 1

Here is a basic overview of PreparedStatement. I will assume at this point you've already created your Connection, and named it "con".
Let's also assume that you've acquired an int value from somewhere and named it "employeeId".
NOTE: This is untested code! I've left out extraneous details, such as storing the results in a ResultSet, and also any try/catch statements.
final String MY_SELECT_STATEMENT = "SELECT * FROM EMPLOYEES WHERE empId = ?";
PreparedStatement prepState = con.prepareStatement(MY_SELECT_STATEMENT);
prepState.setInt(1, employeeId);
prepState.execute();See the question mark(?) in the query String called MY_SELECT_STATEMENT? You can put a "?" anywhere you want to put in a variable.
The next line to note is the prepState.setInt(1, employeeId) line. The "1" refers to the "?" in the query. If there was another "?", then it would be "2".
The prepState object has other methods, such as setString, etc. This should correspond to the type of data that your setting.
Not only is this cleaner and a more accepted way of running queries, but there are also some security upsides to this, as it makes SQL injection harder (if not impossible) for hackers.
That should get you started. Definitely read the link in the previous posters msg.
Regards.