Unable to set string in prepared statement

Question

Hi all,
I just want to set an string to a prepared stmt.
the setting string is in the format..... the integers with comma saparated....
str="23,55,22"
ps.setString(1,str)
The prepare statement is taking only the first integer... i.e. 23
can any one help me out..........
thanks in advance,
prakhyath

Answer 1

if i am not mistaken.... If I create the Prepared
Statement after receiving the arguments that are to
be provided to it.... the actual purpose.. Of using
a prepared statement is not served at all....Not creating a new Statement each time, is only one of the purposes of PreparedStatement. In this case, since the arguments should be ints (and I hope you are checking that), then it doesn't make much of a difference. But a PreparedStatement is alos used to easily facilitate the proper quoting and escaping of the parameters set, which almost eliminates any chance of an SQL injection attack. There are also a few other convienences associated with a PreparedStatement, but, in this case, you are probabyl right in that there is no advantage of PreparedStatement over Statement (as long as you are checking that the arguments provided are actually ints, otherwise you are opening yourself up to an injection attack).