PreparedStatement with no ? in the where clause

Question

I know, for PreparedStatement I need to have the SQL expression fed into the PreparedStatement like this

 String updateStatement =
        "update " + dbName + ".COFFEES " +
        "set TOTAL = TOTAL + ? " +
        "where COF_NAME = ?";

However, can I feed the update statement with the full where clause without "?"

For example

 String updateStatement =
        "update " + dbName + ".COFFEES " +
        "set TOTAL = TOTAL + ? " +
        "where COF_NAME = 'aaa";

It is just cause I get the where as a parameter in my function, and I don't think it would be efficient to parse the string to break it up.

You only need the question mark for dynamic parameters. You are able to hardcode the where clause. — OneCricketeer, Jun 04 '16 at 17:33
If you don't need parameters, you don't need to use them. Did you even try before asking this question? — Mark Rotteveel, Jun 04 '16 at 17:52
@MarkRotteveel I dont ask questions if I didnt face a trouble. I am new to preparedstatement. I use it successfully in insert. But with update, I am using it and I am getting exception. So I wanted to know if the source of my problem is the non "?" in where or something else. With Cricket comment, I was able to confirm that it is something else. Sqls exceptions are not very trivial to figure out whats wrong with them. I couldve posted the exception and ask people to solve it for me but I prefer to find out myself. Anyways thanks for the comment — Snake, Jun 04 '16 at 17:57
Note that if you're getting a part of the `WHERE` clause as a parameter from a potentially unsafe source (user input / configuration), embedding that into the prepared statement will make it vulnerable to SQL injection. — Mick Mnemonic, Jun 04 '16 at 18:11
Next time you're faced with such a problem, post the actual code and the exception instead of chasing hypotheticals. — Mark Rotteveel, Jun 04 '16 at 18:21

score 0 · Accepted Answer · answered Jun 04 '16 at 17:56

0

The purpose of using prepared statement is to have dynamic variables, but as you're asking if you can hard code the whole where clause, yes you can hard code it.

answered Jun 04 '16 at 17:56

hulkinBrain

746
8
28

Sweet and straightforward answer. Thank you – Snake Jun 04 '16 at 17:58
No problem :D but try to have dynamic variables as it is more secure. As mentioned by @Mick Mnemonic – hulkinBrain Jun 04 '16 at 18:20

PreparedStatement with no ? in the where clause

1 Answers1