SQL problem

Question

I've got a problem with a servlet I'm writing. Here's a code snippet:
if(operation.equals("Lookup details"))
          {     //get customer details
               String Hnum = req.getParameter("HouseNum");
               String Pcode = req.getParameter("PostCode");
              String sql = "SELECT * FROM Customer WHERE house_num = " Hnum " AND postcode = '" Pcode "'";
              String url = "jdbc:pointbase:server://localhost:9092/projectdb";
              Connection con;
              Statement stmt;
              ResultSet rs;
               try {
                    Class.forName("com.pointbase.jdbc.jdbcUniversalDriver");
               catch(ClassNotFoundException ex) {
                    out.println("Failed to find driver");
               try {
                    con = DriverManager.getConnection(url, "PBPUBLIC", "PBPUBLIC");
                    stmt = con.createStatement();
                    //execute query
                    rs = stmt.executeQuery(sql);
               catch(SQLException ex) {
                    out.println("SQL Exception");
                    out.println("" + ex);
          }When it comes to actually executing the sql command I get the following error:
SQL Exception
java.sql.SQLException: Expected to find "end of SQL command" instead found "POSTCODE" at position 46.
I can't quite see whats wrong with my SQL string, its probably something simple tho. Any ideas?

Answer 1

For sure (200%) your request does not contain HouseNum parameter.
You should check presence of HouseNum parameter for instance like:
String hnum=req.getParameter("HouseNum");
if(hnum==null || hnum.trim().length()==0)
   //do something here - for instance put default HouseNum value like:
   hnum="1"
}