SQL Insert Error

Question

I am trying to take data from a form and insert it into the mySQL db.
this is my update stuff:
s = "INSERT INTO users ";
s += " "(" id"," name"," email"," age"," gender"," zipcode"," username"," password")"";
s += " VALUES "("'"+name+"'"," '"+email+"'"," '"+age+"'"," '"+gender+"'"," '"+zipcode+"'"," '"+username+"'"," '"+password+"'")"";
PreparedStatement stmt = conn.prepareStatement();
stmt.executeUpdate(s);
out.write("Updating");
And then I get this error:
Ex-Message :Syntax error or access violation, message from server: "You have an error in your SQL syntax near '' at line 1" Ex-Code :1064 Ex-SQLState:42000 Ex-Next :null
Any ideas?

Answer 1

Your prepared statement should look something like this:
s = "INSERT INTO users ";
s += " (name, email, age, gender, zipcode, username, password)";
s += " VALUES (?,?,?,?,?,?,?)";
stmt.setString( 1, "value for name" );
stmt.setString( 2, "value for email" );
stmt.setInt( 3, 44);
// some info on how to set the type of a parameter value:
// http://developer.java.sun.com/developer/onlineTraining/Database/JDBC20Intro/JDBC20.html#JDBC208
...http://developer.java.sun.com/developer/onlineTraining/Database/JDBC20Intro/JDBC20.html#JDBC207
Try to fill out the following value for name:
"(=enter)
UNION select 1 as 'one' --"
I am not sure if prepared statements take care of sql insertion
http://www.sensepost.com/misc/SQLinsertion.htm
If it doesn't I would replace the ' with '' (1 single quote with 2 single quotes)