Problem searching for data in database

Question

hello, im facing a problem here. Actually i have 2 files,jsp and a javabean file. The jsp files basically contains a few radio buttons and a text field. Now what im planning to do here is if user enter a value in the text field and selects the appropriate radio button, it will basically perform a search. The problem here is its not displaying any results although that particular data is in the database.
Actually the real problem is its not passing the data to the javabean. This is how the statement looks like in the JSP file
String field = request.getParameter("searchfield");
ResultSet rs = ad.searchFirstName(field);
searchfield = name of the text field
ad = name of the usebean id
searchFirstName = name of the method in the javabean that will perform this search function
Now the javabean file
public ResultSet searchFirstName(String field)
This is how the method declaration looks like
the sql statement is stated as below
SELECT * from PersonalInfo where FirstName LIKE '%field%' order by FirstName;
Everything ok(no errors in code) but i realise that its not displaying any data. i think its not passing the value from the jsp text field to the javabean. This is because if i replace the "field" with a data in the database, it displays the data. But if i dont, it just dont display any data. How can i pass a variable that user enter in the jsp text field file to a javabean file for processing..
Pleaseee help..i have been working on this for quite some time. Thanks in advance..

Answer 1

You might need something like this:
String sql = "SELECT * from PersonalInfo where FirstName LIKE '%" + field + "%' order by FirstName";
Even better would be to use a prepared Statement and preventing bad field value like M'Hael from ruining your code (the quote in the name would break your SQL statement)
String sql = "SELECT * from PersonalInfo where FirstName LIKE ? order by FirstName";
PreparedStatement stmt = connection.prepareStatement(sql);
stmt.setString(1, "%" + field + "%");
ResultSet rs = stmt.execute();Cheers,
evnafets