Using String argument with a SQL statment in a method block.

[stevnlon]

I wonder if i could pick anyones brains on somthing?

public void show(String add)
   {

     try
        {
           statement.execute("select * from Staff_Details WHERE Address2 =" + add);

This is a section of code im working on. The string variable add at the end of the SQL statement is not working for me. But if i say, put in the value that, add , references, from the argument passed in the main method ie.
'London' in single quotes, it works fine. ie.

statement.execute("select * from Staff_Details WHERE Address2 = 'London'" );

I need to use the value passed in the argument. I think i need to cast this value from a String variable add to some other type, within the SQL statement?

Can anyone help me? :(

Regards

Steven

[kvprajapati]

You have to wrap up value of add variable with single quote.

public void show(String add)
   {
statement.execute("select * from Staff_Details 
     WHERE Address2='" + add + "'");
   ....
  }

[stevnlon]

BINGO! Thanks thats great, i was trying to do that, but not in the syntax you used. I was just doing ("SQL statment " + 'add');

[masijade]

What happens if the String argument contains a single quote? Or even worse, something like

show("';delete from Staff_Details WHERE Address2 <> '");

Use a PreparedStatement.
http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html