SQL Query in JSP with variable problem

Question

Researching this but I haven't found an answer yet. I want to pass a user variable to the SQL query. Anyone know how? Thought the form call out might work but it doesn't. Thanks!     <%
     String selectX = request.getParameter("choice");
     String pSQLStr = "SELECT asset, tenant FROM fritco WHERE asset = '::selectX::'";
          try
          Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
          Connection con = DriverManager.getConnection("jdbc:odbc:MyDataSource", "username", "password");
          Statement stmt = con.createStatement();
          ResultSet result = stmt.executeQuery(pSQLStr);

Answer 1

Yes.
Use a Prepared Statement.
Saves you from sql injection attacks.
String selectX = request.getParameter("choice");
String pSQLStr = "SELECT asset, tenant FROM fritco WHERE asset = ?";
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
Connection con = DriverManager.getConnection("jdbc:odbc:MyDataSource", "username", "password");
PreparedStatement stmt = con.prepareStatement(pSQLStr);
stmt.setString(1, selectX);
ResultSet result = stmt.executeQuery(); Suggestions for improvements.
- Set up a JNDI datasource to retrieve your connection from. WIll do connection pooling for you, rather than creating a new DB connection each time.
- Don't have any sql code in your JSP at all - that should be in beans.
- If sql code MUST be in your JSP, use a taglib for it like the JSTL sql taglib
- Don't use scriptlet code (<% %>) in JSPs. If you want to run java code use beans/servlets.
Cheers,
evnafets