sql语句在jsp中不起作用

Question

这是我拥有的代码，我认为它的 Sql 字符串无法正常工作。我能够查看表格并点击编辑字段，但我只能更新第一行。我希望能够选择一行，然后根据其 id 对其进行编辑。

//Database View
<%@ page import="java.sql.ResultSet" %>
<%@ page import="java.sql.SQLException" %>
<%@ page import="java.sql.Statement" %>
<%@ page import="java.sql.Connection" %>
<%@ page import="java.sql.DriverManager" %>

<html>
<head>
    <title>Inventory</title>
</head>
<body>

    <%
    Connection connect = null;
    Statement s = null;

    try {
        Class.forName("com.mysql.jdbc.Driver");

        connect =  DriverManager.getConnection("jdbc:mysql://localhost/client", "rootroot", "rootroot");

        s = connect.createStatement();

        String sql = "SELECT * FROM  client ORDER BY id ASC";

        ResultSet rec = s.executeQuery(sql);
        %>
        <table width="600" border="1">
          <tr>
            <th width="91"> <div align="center">id </div></th>
            <th width="198"> <div align="center">Email </div></th>
            <th width="97"> <div align="center">CountryCode </div></th>
            <th width="59"> <div align="center">Budget </div></th>
            <th width="71"> <div align="center">Edit </div></th>
          </tr> 
            <%while((rec!=null) && (rec.next())) { %>
                  <tr>
                    <td><div align="center"><%=rec.getString("id")%></div></td>
                    <td><%=rec.getString("first_name")%></td>
                    <td><%=rec.getString("last_name")%></td>
                    <td><div align="center"><%=rec.getString("blood_type")%></div></td>
                    <td align="right"><%=rec.getString("gender")%></td>

                    <td align="center"> <a href="editpage.jsp?id=<%=rec.getString("id")%>">Edit</a></td>
                  </tr>
            <%}%>
        </table>      
        <%  
        } catch (Exception e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }

        try {
            if(s!=null){
                s.close();
                connect.close();
            }
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }
    %>
</body>
</html>

//Edit Page 
<%@ page import="java.sql.ResultSet" %>
<%@ page import="java.sql.SQLException" %>
<%@ page import="java.sql.Statement" %>
<%@ page import="java.sql.Connection" %>
<%@ page import="java.sql.DriverManager" %>

<html>
<head>
    <title>ThaiCreate.Com JSP Tutorial</title>
</head>
<body>

    <%  
    Connection connect = null;
    Statement s = null;

    try {
        Class.forName("com.mysql.jdbc.Driver");

        connect =  DriverManager.getConnection("jdbc:mysql://localhost/client", "rootroot", "rootroot");

        s = connect.createStatement();

        String sql ="SELECT * FROM client";

        ResultSet rec = s.executeQuery(sql);
        if(rec != null) {
            rec.next();
        %>
    <form name="frmUpdate" method="post" action="SaveEdit.jsp?id=<%=rec.getString("id")%>"> 
        Update Form
            <table width="428" border="1">  
            <tr>
                <th width="181">
                <div align="left">Product ID </div></th>
                <td width="231"><%=rec.getString("id")%></td>
            </tr>
            <tr>
                <th width="181">
                <div align="left">Name </div></th>
                <td><input type="text" name="txtName" size="20" value="<%=rec.getString("first_name")%>"></td>
            </tr>
            <tr>
                <th width="181">
                <div align="left">Email </div></th>
                <td><input type="text" name="txtEmail" size="20" value="<%=rec.getString("last_name")%>"></td>
            </tr>
            <tr>
                <th width="181">
                <div align="left">CountryCode </div></th>
                <td><input type="text" name="txtCountryCode" size="2" value="<%=rec.getString("blood_type")%>"></td>
            </tr>
            <tr>
                <th width="181">
                <div align="left">Budget </div></th>
                <td><input type="text" name="txtBudget" size="5" value="<%=rec.getString("gender")%>"></td>
            </tr>

            </table> 
        <input type="submit" value="Save">
        </form> 

        <% }

        } catch (Exception e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }

        try {
            if(s!=null){
                s.close();
                connect.close();
            }
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }
    %>
</body>
</html>

// save page 
<%@ page import="java.sql.ResultSet" %>
<%@ page import="java.sql.SQLException" %>
<%@ page import="java.sql.Statement" %>
<%@ page import="java.sql.Connection" %>
<%@ page import="java.sql.DriverManager" %>

<html>
<head>
    <title>Hello World</title>
</head>
<body>

    <%  
    Connection connect = null;
    Statement s = null;

    try {
        Class.forName("com.mysql.jdbc.Driver");

        connect =  DriverManager.getConnection("jdbc:mysql://localhost/client", "rootroot", "rootroot");

        s = connect.createStatement();

        String strCustomerID = request.getParameter("id");
        String strName = request.getParameter("txtName");
        String strEmail = request.getParameter("txtEmail");
        String strCountryCode = request.getParameter("txtCountryCode");
        String strBudget = request.getParameter("txtBudget");



        String sql = "UPDATE client " +
                "SET first_name = '"+ strName + "' " +
                ", last_name = '"+ strEmail + "' " +
                ", blood_type = '"+ strCountryCode + "' " +
                ", gender = '"+ strBudget + "' " +

                " WHERE id = '" + strCustomerID + "' ";
         s.execute(sql);

         out.println("Record Update Successfully");

        } catch (Exception e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }

        try {
            if(s!=null){
                s.close();
                connect.close();
            }
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            out.println(e.getMessage());
            e.printStackTrace();
        }
    %>
</body>
</html>

Answer 1

请尝试 s.executeUpdate(sql);而不是 s.execute(sql);

Answer 2

首先为 Elliott Frisch 所说的 +1。这种意大利面条式代码是非常糟糕的做法。

无论如何，如果我正确理解您的用例，那么您需要在编辑页面上从 URL/request 获取 id 参数并添加到选择适当的条件中，使其看起来像

"SELECT * FROM client WHERE id = '" + clientId + "' "

如果您不将条件放入其中，它将始终返回整个表，并且根据您的代码，您只需获取第一行并忽略其余行。这是使用 DB 的非常低效的方式。

您应该考虑的另一件事是绑定和所谓的preparedStatement - 尝试用谷歌搜索并了解一些相关信息。使用它的主要原因是避免 SQL 注入，使用它有人可以很容易地弄乱或破坏您的数据库数据。

我个人也会通过列出您真正需要的所有列来替换 *。