做毕业设计又遇到郁闷的问题了,高手帮忙
源码如下:
<%@ page contentType= "text/html;charset=GB2312 " %>
<%@ page import= "java.sql.* " %>
<HTML>
<BODY>
<% Connection con;
Statement sql;
ResultSet rs;
try
{
Class.forName( "sun.jdbc.odbc.JdbcOdbcDriver ");
}
catch(ClassNotFoundException e)
{
out.print( "该数据驱动方式不存在! ");
}
//try
//{
con=DriverManager.getConnection( "jdbc:odbc:bysj ", "sa ", "513278 ");
sql=con.createStatement();
String userID=request.getParameter( "userID ");
String password=request.getParameter( "userpassword ");
String sqlString =new String( "SELECT userID,password FROM user WHERE userID= ' "+userID+ " ' ");//错误所在行
rs=sql.executeQuery(sqlString);
if(!rs.next())
{
out.print( "该用户不存在！请 <a href= 'login.jsp '> 重新登陆 </a> ");
}
else{
if(!rs.getString(3).equals(password))
out.print( "您输入的密码不正确！请 <a href= 'login.jsp '> 重新登陆 </a> ");
else
{
if(rs.getInt(5)==1)
response.sendRedirect( "usermain.jsp ");
if(rs.getInt(5)==2)
response.sendRedirect( "managermain.jsp ");
if(rs.getInt(5)==1)
response.sendRedirect( "leader.jsp ");
}
}
con.close();
//}
//catch(SQLException e)
//{
// out.print( "SQL异常！ ");
//}
%>
</BODY>
</HTML>
解释执行的时候错误显示在这行:
String sqlString =new String( "SELECT userID,password FROM user WHERE userID= ' "+userID+ " ' ");
rs=sql.executeQuery(sqlString);
错误为:
java.sql.SQLException: [Microsoft][ODBC SQL Server Driver][SQL Server]在关键字 'user ' 附近有语法错误。
sun.jdbc.odbc.JdbcOdbc.createSQLException(Unknown Source)
sun.jdbc.odbc.JdbcOdbc.standardError(Unknown Source)
sun.jdbc.odbc.JdbcOdbc.SQLExecDirect(Unknown Source)
sun.jdbc.odbc.JdbcOdbcStatement.execute(Unknown Source)
sun.jdbc.odbc.JdbcOdbcStatement.executeQuery(Unknown Source)
org.apache.jsp.checklogin_jsp._jspService(checklogin_jsp.java:77)
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:384)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:320)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:266)
javax.servlet.http.HttpServlet.service(HttpServlet.java:803)
我看不出来SQL语句有什么问题.
请高手指点.很急!!
[解决办法]
String sqlString =new String( "SELECT userID,password FROM user WHERE userID= ' "+userID+ " ' ");//???
String sqlString = "select userID from user where UserID= ' "+userID+ " ' and password= ' "+Password+ " ' ";
这样就可以了，但是会出现SQL语句注入这个安全隐患。
[解决办法]
userID字段是字符型吗？
[解决办法]
user是关键字
String sqlString =new String( "SELECT [userID],[password] FROM [user] WHERE [userID]= ' "+userID+ " ' ");
