未能转换为内部表示形式的JDBC [英] Fail to convert to internal representation JDBC

问题描述

好的，这是我的代码

public static ArrayList getMaterialerFraOrdreNr(String s_date, String e_date) throws SQLException, InterruptedException {
    int tal = 0;

    ArrayList nameOfColumns = getNameOfColumns();                     // name of columns
    ArrayList orderNumber = getOrdre_Nr_FromDB(s_date, e_date);           // order number 

    //første loop kører gennem number of columns
    //anden loop kører gennem name of column
    ResultSet rs = null;
    Connection con = null;

    try {
        Class.forName(DB.driver);
        con = DriverManager.getConnection(DB.URL, DB.ID, DB.PW);

        for (int i = 1; i < orderNumber.size(); i++) {
            for (int j = 1; j < nameOfColumns.size(); j++) {

                String nameOfColum = (String) nameOfColumns.get(i);
                int orderNr = (Integer) orderNumber.get(j);
                System.out.println("orderNr  " + orderNr);
                //SELECT v1001 FROM ORDRE_spec WHERE  ordre_nr = 1;
                String query = "SELECT ? AS ans FROM ordre_spec WHERE ordre_nr = ?";
                PreparedStatement prest = con.prepareStatement(query);

                prest.setString(1, nameOfColum);
                prest.setInt(2, orderNr);
                System.out.println("orderNr  "  + orderNr);
                System.out.println("nameOfColum  =   " + nameOfColum);
                rs = prest.executeQuery();
                if(rs.next()){


                    tal = rs.getInt("ans");

                    MaterialeNum.add(tal);
                    System.out.println("materiale num =    " + MaterialeNum);

                }
            }

        }

    } catch (ClassNotFoundException | SQLException ee) {
        System.out.println("fail og der er så her");
        System.err.println(ee);
    } finally {

        con.close();
    }
    System.out.println(kundeNum.toString());
    return kundeNum;

}

public static void main(String[] args) throws SQLException, InterruptedException {

    NewClass.getMaterialerFraOrdreNr("1990-10-10", "2020-10-10");

}

我的问题是我遇到了java.sql.SQLException:无法转换为内部表示形式

And my problem is that I'm getting a java.sql.SQLException: Fail to convert to internal representation

我真的看不到错误应该是什么..如果能看到错误，请给我帮助:)

I really cant see what the error should be.. plz help if you can see the error :)

推荐答案

String query = "SELECT ? AS ans FROM ordre_spec WHERE ordre_nr = ?";

您不能参数化列名.您只能参数化列值.

You cannot parameterize column names. You can only parameterize column values.

基本上，您需要执行以下操作:

Basically you need to do:

String query = "SELECT " + nameOfColum + " AS ans FROM ordre_spec WHERE ordre_nr = ?";

请记住，如果最终用户可以控制nameOfColum，则很容易进行SQL注入.如果确实是这种情况，您可能想对例如\w+，然后继续.

Keep in mind that this is prone to SQL injection if nameOfColum is controllable by enduser. If this is indeed the case, you may want to perform string matching on e.g. \w+ before continuing.

这篇关于未能转换为内部表示形式的JDBC的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！