带有复选框的Java MYSQL选择[重复]

Question

可能重复：
PreparedStatement IN clause alternatives?

我想根据复选框选择从 MYSQL 中进行选择。 （复选框有 ID，从数据库中选择应该选择 where ID= ? -> 选择的 ID）

我用 MVC 架构来组织它：

• 在jsp中是我的表单（是动态的，所以可以有更多）

    <input type="checkbox" name="checkboxes" value="1">XY
    <input type="checkbox" name="checkboxes" value="2">XY
    <input type="checkbox" name="checkboxes" value="3">XY
  

• 在 servlet 中我得到值

    String[] catids  = request.getParameterValues("checkboxes");
  
    //Forward to bean -> doesnt work because catids is like an array
    FrageBean f=FragenBean.getRandomQuestionByCategory(catids);
  

• 我的豆子是：

  public static FrageBean getRandomQuestionByCategory(String catids) {
  ArrayList<Integer> alleFragenIds = new ArrayList<Integer>();
  
  DatabaseMetaData dbmd;
  Statement sql;
  Connection db = null;
  
  
  try {
      Class.forName("com.mysql.jdbc.Driver");
  } catch (ClassNotFoundException ex) {
      System.out.println("driver not found");
  }
  try {
      db = DriverManager
              .getConnection("jdbc:mysql://localhost:3306/xyz?"
              + "user=root&password=xyz");
      dbmd = db.getMetaData();
  
      System.out.println("Connected with: " + dbmd.getUserName() + " | "
              + "Connection to: " + dbmd.getDatabaseProductName() + " " + dbmd.getDatabaseProductVersion() + " successful.\n");
      sql = db.createStatement();
  } catch (SQLException ex) {
      System.out.println("Error: " + ex);
  }
  
  try {
  
      String query = "select id from quest where quest_id=?";
      PreparedStatement prest = db.prepareStatement( query);
  
      prest.setString(1, catids);
  
  
      ResultSet rs = prest.executeQuery();
      ArrayList fragenliste = new ArrayList();
      while (rs.next()) {
          int fragenid = rs.getInt("id");
          alleFragenIds.add(fragenid);
  
      }
  
      rs.close();
      db.close();
  
  
  } catch (SQLException ex) {
      System.out.println("Error: " + ex);
  }
  
  Random r = new Random();
  int frageIndex = r.nextInt(alleFragenIds.size());
   System.out.println("Contents of al: " + alleFragenIds);
  return new FrageBean(alleFragenIds.get(frageIndex));
  
  }
  

目前它只对一个 id 有效（因为我只有一个选择）。我怎样才能用复选框做到这一点？如何将“catids”转发到 bean 并创建 mysql-query 动态？ （从 fragen 中选择 id，其中 kategorie_id= [ALL CHECKED BOXES]）

提前致谢！！！！

Answer 1

@RaisAlam 的回答很危险，因为它容易受到 SQL 注入的影响。这是一个固定版本：

public  void displayRecords(String[] catids) {
    try {
        String queryStart = "select id from quest where quest_id in ( ";
        String queryMiddle = "";
        String prefix = "";
        String queryEnd = " )";
        String query = "";

        if (catids != null && catids.length > 0) {
            for (String id : catids) {
                queryMiddle = queryMiddle + prefix + "?";
                prefix = ",";
            }
            query = queryStart + queryMiddle + queryEnd;
            System.out.println(query);
            Class.forName(....);
            Connection conn = DriverManager.getConnection(....);
            PreparedStatement stmt = conn.createPreparedStatement(query);
            int i = 1;
            for (String id : catids) {
                stmt.setInt(i++, Integer.parseInt(id));
            }
            ResultSet rs = stmt.executeQuery(query);
            while (rs.next()) {
                int fragenid = rs.getInt("id");
                System.out.println("ID = " + fragenid);
            }
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

为每个参数使用带有占位符的 PreparedStatement 是避免 SQL 注入的“最佳实践”方式。

Answer 2

在您的班级中创建以下方法。放置正确的驱动程序类和 url 连接，并将 catids 作为字符串数组传递。

假设：我假设列 "quest_id" 是表 quest 中的 int 类型。

 public  void displayRecords(String[] catids)
{
    try
    {

        String queryStart = "select id from quest where quest_id in ( ";
        String queryMiddle = "";
        String prefix = "";
        String queryEnd = " )";
        String query = "";

        if (catids != null && catids.length > 0)
        {
            for (String id : catids)
            {
                queryMiddle = queryMiddle + prefix + id;
                prefix = ",";
            }

            query = queryStart + queryMiddle + queryEnd;
            System.out.println(query);

            Class.forName("DriverClass....................");
            Connection conn = DriverManager.getConnection("connection url ..................");
            Statement stmt = conn.createStatement();
            ResultSet rs = stmt.executeQuery(query);

            while (rs.next())
            {
                int fragenid = rs.getInt("id");
                System.out.println("ID = " + fragenid);
            }
        }
    }
    catch (Exception e)
    {
        e.printStackTrace();
    }
}