Java mysql query not working

Question

Im stuck and frustrated over these lines of codes:

 String updateSQL="UPDATE " + tableName + " set " + secondColumn + "='"+ value2 + "',"+ thirdColumn + "='"+ value3 +"'" + "," + fourthColumn +"='"+ value4 +"'" + "where " + firstColumn + " = "+ checkvalue ;

Im getting this Query to work perfectly! Though i have another Query that doesn't run perfect but which is in the same style:

 String updateSQL="UPDATE " + tableName + " set " + secondColumn + "='"+ value2 +"'" + ","+ thirdColumn + "='"+ value3 +"'" + "," + fourthColumn +"='"+ value4 +"'" + "," + fifthColumn +"='"+ value5 +"'" + "where " + firstColumn + " = "+ checkvalue ;

When running this line of code when trying to update i recieve the error Message "Unknown column in 'PNO3' in the Where clause"

Though i know i have PNO3 in the first column, and when doing the same with the first Query it finds it? any help?

Im using this switch statement to make sure that the columns point to the right ones.

 switch (tableName) { 
 case "s": 
 firstColumn = "ID";
 secondColumn = "Namn";
 thirdColumn = "Efternamn";
 fourthColumn = "Adress";
 break;
 case "p":
 firstColumn = "PNO";
 secondColumn = "PNAME";
 thirdColumn = "COLOR";
 fourthColumn = "WEIGHT";
 fifthColumn = "CITY";
 break;
 case "j":
 firstColumn = "JNO";
 secondColumn = "JNAME";
 thirdColumn = "CITY"; 
 break;
 case "spj":
 firstColumn = "SNO";
 secondColumn = "PNO";
 thirdColumn = "JNO";
 fourthColumn = "QTY";
 break;
 }

• Luiggi Mendoza: Looks like you're sending the wrong column names for your table PNO3. Log the updateSQL before being executed and check if you can run it from your favorite MySQL Query IDE.
• Jon Skeet: First thing to do: stop including values directly in your SQL. Use parameterized SQL instead.
• Joe Phillips: Second, listen to Jon Skeet
• Samuel O'Malley: You really need to use prepared statements, that code is rediculously hard to follow.
• Looptech: Ok i will check prepared statements :)

Answer 1

Your second query is missing single quotes around checkvalue othewise it will be treated as a column name and not a value (assuming firstColumn is varchar). Should be:

String updateSQL="UPDATE " + tableName + " set " + secondColumn + "='"+ value2 +"'" + ","+ thirdColumn + "='"+ value3 +"'" + "," + fourthColumn +"='"+ value4 +"'" + "," + fifthColumn +"='"+ value5 +"'" + "where " + firstColumn + " = '"+ checkvalue + "'";

Note: you should really use a PreparedStatement instead of string concatenation. It is not just a matter of readability but a security issue - your code is vulnerable to SQL injection

Answer 2

Unable to tell exact problem, but I guess * firstColumn is Varchar(), if yes add single quote to status value. OR * you are passing wrong column name to your table.

Its would be very helpfull if you had posted the error.

SUGGESTION : Do use parameterized syntax since they are easy to read than yours.

• Looptech: i added my switch statement to show you that it is pointing right.
• sam: try adding single quote in the firstColumn;firstColumn='"+ value +"'