Problem while doing insert

Question

Hello.
I'm trying to write the following String containing an XML document, in a MySql database:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ReporteHoras SYSTEM "ReporteHoras.dtd">
<ReporteHoras>
<Persona nombre="Daniel">
<Fecha dia="1/11/2004" horas_teoricas="8">
<Proyecto cod="001">
<Tarea nombre="x">
<Horas>8</Horas>
</Tarea>
<Tarea nombre="y">
<Horas>5</Horas>
</Tarea>
</Proyecto>
</Fecha>
<Fecha dia="2/11/2004" horas_teoricas="7">
<Proyecto cod="010">
<Tarea nombre="z">
<Horas>8</Horas>
</Tarea>
</Proyecto>
</Fecha>
</Persona>
</ReporteHoras>
And I get the following exception:
(ReportesReceiver.HorasGMSReceiver 219 ) error al ejecutar tareas SQL: java.sql.SQLException: Syntax error or access violation, message from server: "You have an error in your SQL syntax near 'VALUES ('91750418', 'horasgms', '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!D' at line 1"
4729468 [imqConsumerReader-0-8919380558701437696-0] ERROR starting.src.java.ReportesReceiver.HorasGMSReceiver - error al ejecutar tareas SQL: java.sql.SQLException: Syntax error or access violation, message from server: "You have an error in your SQL syntax near 'VALUES ('91750418', 'horasgms', '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!D' at line 1"
java.sql.SQLException: Syntax error or access violation, message from server: "You have an error in your SQL syntax near 'VALUES ('91750418', 'horasgms', '<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!D' at line 1"
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:1697)
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1083)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1142)
at com.mysql.jdbc.Connection.execSQL(Connection.java:1876)
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:1590)
at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1653)
at com.mysql.jdbc.PreparedStatement.executeUpdate(PreparedStatement.java:1492)
at starting.src.java.ReportesReceiver.HorasGMSReceiver$GMSListener.onMessage(HorasGMSReceiver.java:210)
at com.sun.messaging.jmq.jmsclient.MessageConsumerImpl.deliverAndAcknowledge(MessageConsumerImpl.java:247)
at com.sun.messaging.jmq.jmsclient.MessageConsumerImpl.onMessage(MessageConsumerImpl.java:210)
at com.sun.messaging.jmq.jmsclient.SessionReader.deliver(SessionReader.java:76)
at com.sun.messaging.jmq.jmsclient.ConsumerReader.run(ConsumerReader.java:153)
at java.lang.Thread.run(Thread.java:534)
It seems that the string contains some illegal characters, but I don't know where they are.
I do the following to insert the data:
java.sql.Connection conn = conexion.getDbConn();
PreparedStatement pstmt = conn.prepareStatement(insertSQLString);
pstmt.setString(1, processId.toString());
pstmt.setString(2, "horasgms");
pstmt.setString(3, contenido);
pstmt.executeUpdate();
Can anyone tell me what am I doing wrong?
Thank you in advance.
Regards.
Dani.

Answer 1

> > <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE ReporteHoras SYSTEM
"ReporteHoras.dtd">This is where the illegal character comes ... I think
it has a problem with "!"
***Annie***Caller = aashu Site = unknown Caller Info. = singh Kind = level1 state = OPEN Errorjava.sql.SQLException: Syntax error or access violation, message from server: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ' Project_Name, Client_Location, Client_Country, Client_Contract_HW INTO client_i' at line 1"
codes as following:-
<%@ page import="java.util.*,java.text.DateFormat, java.io.*,java.net.*,java.sql.*,java.sql.Connection,java.sql.DriverManager,java.sql.Statement"%>
Caller = <%=request.getParameter("caller")%>
     <% String s = request.getParameter("caller");%>
     Site = <%=request.getParameter("site")%>
     <% String s2 = request.getParameter("site");%>
Caller Info. = <%=request.getParameter("callerinfo")%>
     <% String s3 = request.getParameter("callerinfo");%>
     Kind = <%=request.getParameter("kind")%>
     <% String s4 = request.getParameter("kind");%>
state     = <%=request.getParameter("state")%>
     <% String s5 = request.getParameter("state");%>
<%
try     
{ Class.forName("com.mysql.jdbc.Driver").newInstance();
                    // String connectionURL ="jdbc:mysql://localhost:3306/client_db1?user=;password=";
               //Connection con = DriverManager.getConnection(connectionURL,"","");
     Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/client_db1?user=;password=","","");
     Statement st = con.createStatement();
st.executeUpdate("INSERT Client_Name, Project_Name, Client_Location, Client_Country, Client_Contract_HW INTO client_info values('"+s+"', '"+s2+"', '"+s3+"', '"+s4+"', '"+s5+"')"); %>
<%}
catch(Exception e)
{ out.println("Error"+e);
%>[b]