String sql_insert="insert into stu(s_id,s_name,s_sex,s_class) values(" + id + "," + name + "," + sex + "," + s_class + ") ";

这段代码是一个插入数据到数据库的SQL语句，但是存在一个潜在的问题，就是字符串类型的变量没有用单引号包裹。如果这些变量是字符串类型，则应该用单引号包裹，否则数据库可能无法正确解析并插入数据。建议修改为以下代码：

String sql_insert="insert into stu(s_id,s_name,s_sex,s_class) values('" + id + "','" + name + "','" + sex + "','" + s_class + "') ";

这样就可以保证字符串类型的变量被正确地包裹了。另外，为了避免SQL注入攻击，建议使用PreparedStatement来代替Statement。

相关问题

//插入一条记录(输入内容 Scanner scanner = new Scanner(System.in); System.out.print("请输入比赛项目编号："); String id=scanner.nextLine(); System.out.print("请输入比赛项目名："); String name=scanner.nextLine(); System.out.print("请输入比赛时间："); String time=scanner.nextLine(); System.out.print("请输入比赛地点："); String place=scanner.nextLine(); //String sql_insert="insert into stu(s_id,s_name,s_sex,s_class) values('162030302','zyp','F','1620303') "; //String sql_check="select *from stu where s_id='162030302'"; //String sql_insert="insert into stu(s_id,s_name,s_sex,s_class) values(" + id + "," + name + "," + sex + "," + s_class + ") "; String sql_insert="insert into event(\"e_id\",\"e_name\",\"time\",\"place\") values('" + id + "','" + name + "','to_date(" + time + ",'YYYY-MM-DD')','" + place + "') ";最后一句哪里缺少逗号了

在时间字段和地点字段之间缺少逗号。应该改为：

String sql_insert="insert into event(\"e_id\",\"e_name\",\"time\",\"place\") values('" + id + "','" + name + "',to_date('" + time + "','YYYY-MM-DD'),'" + place + "') ";

import java.sql.*; public class b2 { public static void main(String[] args) { try { Class.forName("com.mysql.cj.jdbc.Driver"); } catch (ClassNotFoundException e) { e.printStackTrace(); } String usl="jdbc:mysql://localhost:3306/computer"; String user="root"; String pwd="241356"; try { Connection conn =DriverManager.getConnection(usl,user,pwd); Statement sta = conn.createStatement(); String insertsql = "INSERT INTO stu(id,name,sex,age,major) VALUES(?,?,?,?,?)"; String delectsql = "delect from stu where id=2"; String selectsql = "select * from stu"; sta.executeUpdate(insertsql,new String[] {"8","李商隐","男","18","软件工程"}); sta.executeUpdate(delectsql); ResultSet rs = sta.executeQuery(selectsql); System.out.println("id"+"\t"+"name"+"sex"+"\t"+"age"+"\t"+"major"); while(rs.next()) { System.out.println(rs.getInt(1)+"\t"+rs.getString(2)+"\t"+rs.getString(3) +"\t"+rs.getInt(4)+"\t"+rs.getString(5)); } } catch (Exception e) { e.printStackTrace(); } }

这段代码存在一些错误：

1. `delect` 应该改为 `delete`。

2. `executeUpdate` 方法不支持使用数组方式传递参数，需要使用 `PreparedStatement`。

下面是修改后的代码：

import java.sql.*;

public class b2 {
    public static void main(String[] args) {
        try {
            Class.forName("com.mysql.cj.jdbc.Driver");
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }
        String url = "jdbc:mysql://localhost:3306/computer";
        String user = "root";
        String pwd = "241356";
        try (Connection conn = DriverManager.getConnection(url, user, pwd);
             Statement sta = conn.createStatement();
             PreparedStatement insertSta = conn.prepareStatement("INSERT INTO stu(id,name,sex,age,major) VALUES(?,?,?,?,?)");
             PreparedStatement deleteSta = conn.prepareStatement("DELETE FROM stu WHERE id=?");
             ResultSet rs = sta.executeQuery("SELECT * FROM stu")) {
            insertSta.setString(1, "8");
            insertSta.setString(2, "李商隐");
            insertSta.setString(3, "男");
            insertSta.setInt(4, 18);
            insertSta.setString(5, "软件工程");
            insertSta.executeUpdate();

            deleteSta.setInt(1, 2);
            deleteSta.executeUpdate();

            System.out.println("id\tname\tsex\tage\tmajor");
            while (rs.next()) {
                System.out.println(rs.getInt(1) + "\t" + rs.getString(2) + "\t" + rs.getString(3)
                        + "\t" + rs.getInt(4) + "\t" + rs.getString(5));
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

希望能帮到你！