how to get sting value in query

Question

System.out.print("Enter MName= ");
mname=br.readLine();
su ="UPDATE contact SET mname= "+ mname +" WHERE id="+cid;
System.out.println(su);
n=s.executeUpdate(su);

Answer 1

Sahil Kshirsagar https://stackoverflow.com/questions/36146935/how-to-query-for-a-string-in-java-jdbc

Hope it's helpful to you

Answer 2

You should never use string concatenation to write SQL. This is how you can fall victim to code injection attacks. You should use PreparedStatement instead, as suggested in the stackoverflow article linked by Sakshi.

https://www.baeldung.com/java-statement-preparedstatement